Skip to main content
Information Security

You are not logged in. Your edit will be placed in a queue until it is peer reviewed.

We welcome edits that make the post easier to understand and more valuable for readers. Because community members review edits, please try to make the post substantially better than how you found it, for example, by fixing grammar or adding additional resources and hyperlinks.

Required fields*

2
  • 1
    1.3 doesn't use any hash to MAC data -- it requires AEAD which must be GCM CCM or ChaCha-Poly, none of which involves a hash. The hash in a 1.3 ciphersuite is used only for HKDF in the key schedule, and is NOT required to be the same as the CertVerify signature (always server, optionally client) or any cert signature(s); for those it now has two extensions in ClientHello or CertRequest respectively, sig_algs for handshake and sig_algs_cert for certificate(s). Commented Nov 19, 2024 at 0:39
  • 1
    @dave_thompson_085: Your first statement is wrong. TLS 1.3 uses the hash function to calculate the HMAC over the transcript hash in the Finished message. But it's correct that the signature hash algorithm(s) can be chosen independently from the cipher suit hash algorithm. Commented Nov 19, 2024 at 0:50