RFC 9963

Legacy RSASSA-PKCS1-v1_5 Code Points for TLS 1.3

📅 published April 2026, from ietf

Legacy RSASSA-PKCS1-v1_5 Code Points for TLS 1.3 🎀

Okay bestie, this is RFC 9963 💖. It's an IETF Request for Comments written by David Benjamin of Google LLC and Andrei Popov of Microsoft Corp. It's a Standards Track document, which means it's an official Internet standard. It was published in April 2026 and has ISSN 2070-1721. The title block doesn't list any RFCs that it obsoletes or updates. 🧚

Abstract ✨

This document is all about handing out code points for RSASSA-PKCS1-v1_5 when it's used with client certificates in TLS 1.3 🔐. That matters because it clears a blocker that's been keeping some deployments from moving over to TLS 1.3 💅.

Status of This Memo

This is an Internet Standards Track document 🔥.

This document is a product of the Internet Engineering Task Force (IETF). It represents the consensus of the IETF community. It has received public review and has been approved for publication by the Internet Engineering Steering Group (IESG). For more info on Internet Standards, check Section 2 of RFC 7841 🌸.

Information about the current status of this document, any errata, and how to give feedback on it can be found at https://www.rfc-editor.org/info/rfc9963 🦋.

Copyright Notice

This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents, found at https://trustee.ietf.org/license-info, as they stand on the date this document was published. Please read these carefully, because they spell out your rights and restrictions for this document 📜. Code Components extracted from this document must include Revised BSD License text as described in Section 4.e of the Trust Legal Provisions, and they're provided without warranty as described in the Revised BSD License 🫶.

   1.  Introduction
   2.  Conventions and Definitions
   3.  PKCS #1 v1.5 SignatureScheme Types
   4.  Security Considerations
   5.  IANA Considerations
   6.  References
     6.1.  Normative References
     6.2.  Informative References
   Acknowledgements
   Authors' Addresses

1. Introduction ✨

Okay so, TLS 1.3 [RFC8446] dropped support for RSASSA-PKCS1-v1_5 [RFC8017] in CertificateVerify messages and went all in on RSASSA-PSS instead 💅. RSASSA-PSS is a long-established signature algorithm, but some legacy hardware cryptographic devices just don't support it 🙈. That's not super common on TLS servers, but these devices do sometimes show up on the TLS client side, where they're used for client certificates.

Trusted Platform Modules (TPMs) are everywhere as hardware cryptographic devices, and they're often used to protect TLS client certificate private keys 🔑. The problem is that a large number of TPMs can't produce RSASSA-PSS signatures that work with TLS 1.3 😭. TPM specifications before 2.0 didn't define RSASSA-PSS support at all (see Section 5.8.1 of [TPM12]). TPM 2.0 does include RSASSA-PSS, but only TPM 2.0 devices that are compatible with US FIPS 186-4 can be relied upon to use the salt length matching the digest length, which TLS 1.3 requires (see Appendix B.7 of [TPM2]) 🌈.

So TLS connections that rely on these devices can't migrate to TLS 1.3 💀. Staying on TLS 1.2 leaks the client certificate to network attackers [PRIVACY], and it also keeps these deployments from protecting traffic against retroactive decryption by an attacker with a quantum computer [RFC9954] 😱.

It's also a bit of a mess because TLS negotiates the protocol version before client certificates come into play. Clients send ClientHellos without knowing whether the server will ask them to authenticate with legacy keys. Servers respond with a TLS version and a CertificateRequest without knowing whether the client will answer with a legacy key. If the client and server offer and negotiate TLS 1.3, the connection fails because of the legacy key, even though it used to work fine at TLS 1.2 🥲.

To get out of that failure, one side has to globally disable TLS 1.3, or the client has to implement an external fallback. Disabling TLS 1.3 hurts connections that would otherwise be totally fine, and external fallbacks break TLS's security analysis and may introduce vulnerabilities [POODLE] 🚨.

This document allocates code points so these legacy keys can be used with client certificates in TLS 1.3 🦋. That takes the pressure off implementations to pick one of these problematic mitigations, and it unblocks TLS 1.3 deployment 🎀.

2. Conventions and Definitions 🌸

Here's the deal with the capital-letter key words. "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this document get interpreted as described in BCP 14 [RFC2119] [RFC8174], but only when they show up in all capitals, just like they do here 🧠.

3. PKCS #1 v1.5 SignatureScheme Types 🍓

The following SignatureScheme values are defined for use with TLS 1.3 ✨.

    enum {
        rsa_pkcs1_sha256_legacy(0x0420),
        rsa_pkcs1_sha384_legacy(0x0520),
        rsa_pkcs1_sha512_legacy(0x0620),
    } SignatureScheme;

These code points indicate a signature algorithm that uses RSASSA-PKCS1-v1_5 [RFC8017] with the matching hash algorithm defined in [SHS] 💜. They're only defined for signatures in the client CertificateVerify message, and they're not defined for use in any other context. In particular, servers that want to advertise support for RSASSA-PKCS1-v1_5 signatures in the certificates themselves should use the rsa_pkcs1_* constants defined in [RFC8446] 🫶.

Clients MUST NOT advertise these values in the signature_algorithms extension of the ClientHello. They MUST NOT accept these values in the server CertificateVerify message 🚫.

Servers that want to support clients authenticating with legacy RSASSA-PKCS1-v1_5-only keys MAY send these values in the signature_algorithms extension of the CertificateRequest message, and accept them in the client CertificateVerify message 🌈. Servers MUST NOT accept these code points if they weren't offered in the CertificateRequest message 🙅‍♀️.

Clients with such legacy keys MAY negotiate these signature algorithms if the server offers them 🎀. Clients SHOULD NOT negotiate these signature algorithms with keys that support RSASSA-PSS, though this may not be practical to determine in every application. For example, trying to test a key for support might pop up a message for the user or have other side effects 👀.

TLS implementations SHOULD disable these code points by default. See Section 4 💖.

4. Security Considerations 🔥

The considerations in Section 1 don't apply to server keys, so these new code points are forbidden for use with server certificates. RSASSA-PSS keeps being required for TLS 1.3 servers that use RSA keys. This keeps the impact limited to only the cases where it's actually necessary to unblock TLS 1.3 deployment 🛡️.

When implemented incorrectly, RSASSA-PKCS1-v1_5 admits signature forgeries [MFSA201473]. This is serious, bestie 😭.

Implementations that produce or verify signatures with these algorithms MUST implement RSASSA-PKCS1-v1_5 as specified in Section 8.2 of [RFC8017]. In particular, clients MUST include the mandatory NULL parameter in the DigestInfo structure, and they MUST produce a valid DER [X690] encoding. Servers MUST reject signatures that don't meet these requirements 🚨.

5. IANA Considerations 🧚

IANA has created the following entries in the "TLS SignatureScheme" registry. The "Recommended" column has been set to "N", and the "Reference" column refers to this document 📋.

                 +========+=========================+
                 | Value  | Description             |
                 +========+=========================+
                 | 0x0420 | rsa_pkcs1_sha256_legacy |
                 +--------+-------------------------+
                 | 0x0520 | rsa_pkcs1_sha384_legacy |
                 +--------+-------------------------+
                 | 0x0620 | rsa_pkcs1_sha512_legacy |
                 +--------+-------------------------+

Table 1

6. References 📚

6.1. Normative References

[RFC2119] Bradner, S., "Key words for use in RFCs to Indicate Requirement Levels", BCP 14, RFC 2119, DOI 10.17487/RFC2119, March 1997, https://www.rfc-editor.org/info/rfc2119.

[RFC8017] Moriarty, K., Ed., Kaliski, B., Jonsson, J., and A. Rusch, "PKCS #1: RSA Cryptography Specifications Version 2.2", RFC 8017, DOI 10.17487/RFC8017, November 2016, https://www.rfc-editor.org/info/rfc8017.

[RFC8174] Leiba, B., "Ambiguity of Uppercase vs Lowercase in RFC 2119 Key Words", BCP 14, RFC 8174, DOI 10.17487/RFC8174, May 2017, https://www.rfc-editor.org/info/rfc8174.

[RFC8446] Rescorla, E., "The Transport Layer Security (TLS) Protocol Version 1.3", RFC 8446, DOI 10.17487/RFC8446, August 2018, https://www.rfc-editor.org/info/rfc8446.

[SHS] NIST, "Secure Hash Standard", NIST FIPS 180-4, DOI 10.6028/NIST.FIPS.180-4, August 2015, https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.180-4.pdf.

[TPM12] Trusted Computing Group, "TPM Main, Part 2 - Structures of the TPM", Level 2, Version 1.2, Revision 116, 1 March 2011, https://trustedcomputinggroup.org/wp-content/uploads/TPM-Main-Part-2-TPM-Structures_v1.2_rev116_01032011.pdf.

[TPM2] Trusted Computing Group, "Trusted Platform Module Library, Part 1: Architecture", Family 2.0, Level 00, Revision 01.59, 8 November 2019, https://trustedcomputinggroup.org/wp-content/uploads/TCG_TPM2_r1p59_Part1_Architecture_pub.pdf.

[X690] ITU-T, "Information technology - ASN.1 encoding rules: Specification of Basic Encoding Rules (BER), Canonical Encoding Rules (CER) and Distinguished Encoding Rules (DER)", ITU-T Recommendation X.690, ISO/IEC 8825-1:2021, February 2021, https://www.itu.int/rec/T-REC-X.690.

6.2. Informative References

[MFSA201473] Delignat-Lavaud, A., "Mozilla Foundation Security Advisory 2014-73: RSA Signature Forgery in NSS", 24 September 2014, https://www.mozilla.org/en-US/security/advisories/mfsa2014-73/.

[POODLE] Moeller, B., "This POODLE bites: exploiting the SSL 3.0 fallback", Google Security Blog, 14 October 2014, https://security.googleblog.com/2014/10/this-poodle-bites-exploiting-ssl-30.html.

[PRIVACY] Wachs, M., Scheitle, Q., and G. Carle, "Push away your privacy: Precise user tracking based on TLS client certificate authentication", 2017 Network Traffic Measurement and Analysis Conference (TMA). pp. 1-9, DOI 10.23919/tma.2017.8002897, June 2017, https://doi.org/10.23919/tma.2017.8002897.

[RFC9954] Stebila, D., Fluhrer, S., and S. Gueron, "Hybrid Key Exchange in TLS 1.3", RFC 9954, DOI 10.17487/RFC9954, April 2026, https://www.rfc-editor.org/info/rfc9954.

Acknowledgements 🫶

Thanks to Rifaat Shekh-Yusef, Martin Thomson, and Paul Wouters for giving feedback on this document 💜.

Authors' Addresses 🌸

David Benjamin Google LLC Email: davidben@google.com

Andrei Popov Microsoft Corp. Email: andreipo@microsoft.com

📦 where this page comes from

ietf: rfc9963 2026-04
💖 girlified by claude-haiku-5-5 on 2026-10-19: a language model's rewrite of the original, under its terms