proposal: crypto/tls: disable SHA-1 signature algorithms in TLS 1.2

[FiloSottile]

In TLS 1.2, we still advertise and select (as the final preference) SHA-1 signature algorithms, rsa_pkcs1_sha1 and ecdsa_sha1. (In TLS 1.3 we reject them. In TLS 1.0 they are the only option.)

RFC 9155 made rejecting them a MUST, and we're overdue anyway.

I propose we implement RFC 9155 and remove support for SHA-1 signature algorithms in TLS 1.2.

The GODEBUG setting tlssha1=1 can be used to revert to the previous behavior.

/cc @golang/security

[gopherbot]

Change https://go.dev/cl/658216 mentions this issue: crypto/tls: disable SHA-1 signature algorithms in TLS 1.2

[gabyhelp]

Related Issues

• crypto/tls: disable client-side TLS 1.0 and TLS 1.1 #45428 (closed)
• crypto/tls: back RSA-PSS out of TLS 1.2 in Go 1.13 #32425 (closed)

Related Code Changes

• crypto/tls: disable SHA-1 signature algorithms in TLS 1.2

_{(Emoji vote if this was helpful or unhelpful; more detailed feedback welcome in this discussion.)}