What hash is concatenating with the data to be signed in TLS 1.3 CertificateVerify message? According to specification, to create data that will be signed with server private key for CertificateVerify message, we need to concatenate 64 space characters, the string &quot;TLS 1.3, server CertificateVerify&quot;, null and the hash of all handshake messages to this point. During the handshake process, we choosing the cipher suite and signature scheme...
So, if the cipher suite is, for example, TLS_AES_256_GCM_SHA384 and the signature scheme is rsa_pss_rsae_sha256 (different hash algorithms), hash of which algorithm should be used as handshake hash in data to sign, SHA-384 or SHA-256?
rsa_pss_rsae_sha256 is the signature scheme that defines to use of the SHA-256 during the RSA-PSS signature algorithm.
Since Rabin-Signature Scheme, which is the first true signature scheme, the security of the signature is a part of the hashing a message and that enables us to sign arbitrary long messages, too. The rsa_pss_rsae_sha256 will use SHA-256 to hash the message before signing.
The RSA-PSS also needs a hash function to use in its Message Generation Function 1 (MGF1). RSA-PSS defined in RFC 8017 also known as RSASSA-PSS. The SHA-256 will be used in MFG1, too.
TLS_AES_256_GCM_SHA384: AES-GCM doesn't need the SHA-384. The SHA-384 suffix;

In Pre TLS 1.3, the appending hash function SHA-384 defines PRF to use in key derivation and Finished and HMAC when the cipher suites required.

For cipher suites ending with _SHA384, the PRF is the TLS PRF
[RFC5246] with SHA-384 as the hash function.


In TLS 1.3: TLS 1.3 finally defined a KDF; HKDF that replaces PRF and there is no more need for HMAC since all modes are authenticated encryption modes that use CCM, GCM, and Poly1305 message authenticators.
The hash function in the cipher suite definition represents the hash function that is used to hash the handshake messages for the Finished message and HKDF.



What hash is concatenating with the data to be signed in TLS 1.3 CertificateVerify message?

Therefore it is SHA-384