crypto/tls: disable RSA-PSS in TLS 1.2 again

Signing with RSA-PSS can uncover faulty crypto.Signer implementations,
and it can fail for (broken) small keys. We'll have to take that
breakage eventually, but it would be nice for it to be opt-out at first.

TLS 1.3 requires RSA-PSS and is opt-out in Go 1.13. Instead of making a
TLS 1.3 opt-out influence a TLS 1.2 behavior, let's wait to add RSA-PSS
to TLS 1.2 until TLS 1.3 is on without opt-out.

Note that since the Client Hello is sent before a protocol version is
selected, we have to advertise RSA-PSS there to support TLS 1.3.
That means that we still support RSA-PSS on the client in TLS 1.2 for
verifying server certificates, which is fine, as all issues arise on the
signing side. We have to be careful not to pick (or consider available)
RSA-PSS on the client for client certificates, though.

We'd expect tests to change only in TLS 1.2:

    * the server won't pick PSS to sign the key exchange
      (Server-TLSv12-* w/ RSA, TestHandshakeServerRSAPSS);
    * the server won't advertise PSS in CertificateRequest
      (Server-TLSv12-ClientAuthRequested*, TestClientAuth);
    * and the client won't pick PSS for its CertificateVerify
      (Client-TLSv12-ClientCert-RSA-*, TestHandshakeClientCertRSAPSS,
      Client-TLSv12-Renegotiate* because "R" requests a client cert).

Client-TLSv13-ClientCert-RSA-RSAPSS was updated because of a fix in the test.

This effectively reverts 88343530720a52c96b21f2bd5488c8fb607605d7.

Testing was made more complex by the undocumented semantics of OpenSSL's
-[client_]sigalgs (see openssl/openssl#9172).

Updates #32425

Change-Id: Iaddeb2df1f5c75cd090cc8321df2ac8e8e7db349
Reviewed-on: https://go-review.googlesource.com/c/go/+/182339
Reviewed-by: Adam Langley <agl@golang.org>

1 files changed, 4 insertions, 31 deletions

diff --git a/src/crypto/tls/testdata/Server-TLSv12-RSA-RSAPSS b/src/crypto/tls/testdata/Server-TLSv12-RSA-RSAPSS
index 5ec0f25a17..c260afe296 100644
--- a/src/crypto/tls/testdata/Server-TLSv12-RSA-RSAPSS
+++ b/src/crypto/tls/testdata/Server-TLSv12-RSA-RSAPSS
@@ -1,7 +1,7 @@
 >>> Flow 1 (client to server)
-00000000  16 03 01 00 91 01 00 00  8d 03 03 0f 06 da 7d 85  |..............}.|
-00000010  33 d8 3c c3 ad c5 19 f8  06 d8 f6 02 80 9a fb 8c  |3.<.............|
-00000020  55 a5 6b 67 c4 6e 68 11  74 61 28 00 00 2a c0 30  |U.kg.nh.ta(..*.0|
+00000000  16 03 01 00 91 01 00 00  8d 03 03 de a3 85 5b 56  |..............[V|
+00000010  34 e4 d0 57 07 66 8d 3c  39 00 eb 27 02 22 c9 f3  |4..W.f.<9..'."..|
+00000020  23 a6 5e 08 3a 6d 06 09  8f d9 00 00 00 2a c0 30  |#.^.:m.......*.0|
 00000030  00 9f cc a8 cc aa c0 2f  00 9e c0 28 00 6b c0 27  |......./...(.k.'|
 00000040  00 67 c0 14 00 39 c0 13  00 33 00 9d 00 9c 00 3d  |.g...9...3.....=|
 00000050  00 3c 00 35 00 2f 00 ff  01 00 00 3a 00 00 00 0e  |.<.5./.....:....|
@@ -51,31 +51,4 @@
 00000260  f1 6c 04 ed 73 bb b3 43  77 8d 0c 1c f1 0f a1 d8  |.l..s..Cw.......|
 00000270  40 83 61 c9 4c 72 2b 9d  ae db 46 06 06 4d f4 c1  |@.a.Lr+...F..M..|
 00000280  b3 3e c0 d1 bd 42 d4 db  fe 3d 13 60 84 5c 21 d3  |.>...B...=.`.\!.|
-00000290  3b e9 fa e7 16 03 03 00  ac 0c 00 00 a8 03 00 1d  |;...............|
-000002a0  20 2f e5 7d a3 47 cd 62  43 15 28 da ac 5f bb 29  | /.}.G.bC.(.._.)|
-000002b0  07 30 ff f6 84 af c4 cf  c2 ed 90 99 5f 58 cb 3b  |.0.........._X.;|
-000002c0  74 08 04 00 80 49 30 b1  a5 47 19 7f a7 35 61 cb  |t....I0..G...5a.|
-000002d0  dc 41 47 f0 6a 96 e1 63  48 d9 4f d3 a4 ac 06 46  |.AG.j..cH.O....F|
-000002e0  f2 8d 07 95 25 c6 61 59  4a df 35 2e ce dd 71 7e  |....%.aYJ.5...q~|
-000002f0  1e d6 f4 9f 43 93 84 35  6a 98 41 45 16 ee cb 14  |....C..5j.AE....|
-00000300  dd bb 52 27 08 d5 a2 39  e7 6e f6 d6 e4 c6 bd f3  |..R'...9.n......|
-00000310  b6 9b 6d 61 30 2a 07 c6  04 39 87 fd 99 00 15 78  |..ma0*...9.....x|
-00000320  3d bf 20 8c b9 52 fb 5d  c7 b7 77 78 fb 77 2a ac  |=. ..R.]..wx.w*.|
-00000330  f5 3e e5 4b 8f 4d 9b ca  c2 33 1c 66 3c cb e0 1f  |.>.K.M...3.f<...|
-00000340  81 36 78 39 70 16 03 03  00 04 0e 00 00 00        |.6x9p.........|
->>> Flow 3 (client to server)
-00000000  16 03 03 00 25 10 00 00  21 20 79 9a e7 42 96 52  |....%...! y..B.R|
-00000010  f6 52 7d 10 9a 36 9b aa  a7 2f 96 be 5b 0a 3b 40  |.R}..6.../..[.;@|
-00000020  d9 32 3a 0b 17 7b 8d 92  7c 7b 14 03 03 00 01 01  |.2:..{..|{......|
-00000030  16 03 03 00 28 92 3e da  41 d2 87 60 b3 e1 4f f7  |....(.>.A..`..O.|
-00000040  bb b7 09 50 47 2e 05 d5  fe f6 ed 94 ba 3b 60 aa  |...PG........;`.|
-00000050  38 2d b2 38 c7 07 64 63  dd ca 1a 8e ae           |8-.8..dc.....|
->>> Flow 4 (server to client)
-00000000  14 03 03 00 01 01 16 03  03 00 28 00 00 00 00 00  |..........(.....|
-00000010  00 00 00 8e c6 6e 45 21  eb 35 11 7a b5 74 d7 f7  |.....nE!.5.z.t..|
-00000020  67 53 15 23 9d 61 a1 bc  20 10 c8 8e 7e ee 45 fc  |gS.#.a.. ...~.E.|
-00000030  60 13 20 17 03 03 00 25  00 00 00 00 00 00 00 01  |`. ....%........|
-00000040  bf f9 63 b5 b1 39 70 43  c7 62 38 be d1 f5 0d a5  |..c..9pC.b8.....|
-00000050  87 91 95 71 ab 03 c2 08  d0 38 dc 70 9a 15 03 03  |...q.....8.p....|
-00000060  00 1a 00 00 00 00 00 00  00 02 0c 6f b1 f5 45 6d  |...........o..Em|
-00000070  44 2c 1f ec a4 fa 5c c1  aa 23 1e 82              |D,....\..#..|
+00000290  3b e9 fa e7 15 03 03 00  02 02 28                 |;.........(|