crypto/tls: advertise full SHA suite in SignatureHashAlgorithm

[medina]

A simple Go client connecting to a server via TLS1.2 advertises supported algorithms as the equivalent of openssl s_client -sigalgs RSA+SHA256:ECDSA+SHA256:RSA+SHA1:ECDSA+SHA1 -tls1_2, while it should be capable of more. An excerpt of the ClientHello sent from the client is below:

The server (a web load balancing appliance), which has an RSA+SHA256 certificate and a bundled RSA+SHA384 intermediary perhaps reasonably responds with an alert(40) (handshake_failure), whilst internally logging "[h]andshake failure selecting certificate for foo.example.com: Certificate chain uses algorithms not supported by client". On the face of what's presented by the client, this is true.

I believe this is the same issue previously reported by Michael Daffin on the golang-nuts mailing list. In that case, connecting to the specified server using a simulated string of

# "OpenSSL 1.0.2 22 Jan 2015" for `-sigalgs` support
$ openssl s_client \
    -sigalgs RSA+SHA384:RSA+SHA256 \
    -cipher AES256-SHA \
    -tls1_2 \
    -servername foo.example.com \
    -connect foo.example.com:443 -showcerts

yields success.

I believe the GoLang TLS library should advertise the full SHA suite it supports in the SignatureHashAlgorithm.

[mikioh]

Please take a look at https://github.com/golang/go/blob/master/CONTRIBUTING.md.

1. What version of Go are you using (go version)?
2. What operating system and processor architecture are you using?

Seems like this issue is similar to #8190.

[medina]

go version go1.4 darwin/amd64

on OS X 10.9.5. That issue points to the fix I'd suggest as well, however you can check the source to see that it didn't make it into go1.4.1.

[minux]

I think the reason sha512/384 arr not advised is that they are rarely used,
so crypto/TLS chooses not to import the sha512 package.

However, it makes sense that if the program does import crypto/sha512,
crypto/tls should detect that and advise those hash algorithms.

[medina]

crypto/tls may not import crypto/sha512, but crypto/x509 does, with the intent of supporting intermediate certificates such as this. Since the support is there to verify these certs, the support should be there to advertise the capability in TLS1.2 as part of the ClientHello.

[gopherbot]

CL https://golang.org/cl/9415 mentions this issue.

[gopherbot]

CL https://golang.org/cl/9472 mentions this issue.