Duplicate signature algorithm values sent from s2n client

[raycoll]

Problem:

When using s2n with modern security policies, s2n client will send duplicate signature_algorithm extension values. This appears related to how s2n writes entries from it's signature scheme preference list: https://github.com/aws/s2n-tls/blob/main/tls/s2n_signature_scheme.c#L321

I ran something like s2nc -c default_tls13 -i www.amazon.com 443 and generated a packet capture. Here is the signature_algorithm extension

Solution:

Avoid writing duplicated values to the signature_algorithm{_cert} extensions.

• Does this change what S2N sends over the wire? : Yes, this proposal will change s2n client from sending duplicate signature scheme values to a single value.

Requirements / Acceptance Criteria:

• RFC links: https://www.rfc-editor.org/rfc/rfc8446#section-4.2.3
• Related Issues:
• Will the Usage Guide or other documentation need to be updated? No
• Testing:
  • Will this change trigger SAW changes? No
  • Should this change be fuzz tested? No

Out of scope:

N/A