When EdDSA came up the last time, I remember an opinion was that it would be better to save the work to post quantum algorithms. Even though Ed25519 is a nice algorithm, I kind of agree with that. Moving to PQC will be more work that needs to be done, while Ed25519 seems like a nice-to-have for TLS server certificates? Does eDelivery really need publicly trusted Web PKI certificates?
Regards, Tomas ________________________________ From: Servercert-wg <[email protected]> on behalf of Inigo Barreira via Servercert-wg <[email protected]> Sent: Monday, June 10, 2024 4:21 PM To: Ben Wilson <[email protected]>; CA/B Forum Server Certificate WG Public Discussion List <[email protected]>; Q Misell <[email protected]> Subject: Re: [Servercert-wg] Ed25519 certificates FYI. TBD next week at the ETSI ESI meeting. Title: Proposed CR#7 on TS 119 312: Introduce EdDSA incl. its variants (Ed448 and Ed25519) Source: European Commission Abstract: ETSI TS 119 312 provides guidance on selection of cryptographic suites with particular emphasis on interoperability. The Edwards-Curve Digital Signature Algorithm (EdDSA) is a state-of-the-art algorithm for electronic signatures. It is recommended by experts in cryptography and information security and adopted in many Internet security applications and specifications. Unfortunately, the currently published version of TS 119 312 does not reference EdDSA. This change request proposes to add EdDSA as a recommended digital signature algorithm to TS 119 312. The European Commission’s eDelivery Building Block is updating its eDelivery AS4 guidelines and would like to use EdDSA as digital signature algorithm in the updated version. Addition of EdDSA to TS 119 312 would contribute to the continued broad adoption of eDelivery AS4 as an interoperable, open standards-based eDelivery solution based on state-of-the-art security. De: Servercert-wg <[email protected]> En nombre de Ben Wilson via Servercert-wg Enviado el: sábado, 8 de junio de 2024 19:28 Para: Q Misell <[email protected]>; CA/B Forum Server Certificate WG Public Discussion List <[email protected]> Asunto: Re: [Servercert-wg] Ed25519 certificates CAUTION: This email originated from outside of the organization. Do not click links or open attachments unless you recognize the sender and know the content is safe. Hi Q, I'm checking with the crypto team here at Mozilla and will let you know from our perspective. Thanks, Ben On Sat, Jun 8, 2024 at 4:39 AM Q Misell via Servercert-wg <[email protected]<mailto:[email protected]>> wrote: Hi all, At the Tor meeting a few weeks ago I had some discussions with people asking why Ed25519 certificates are not allowed under the BR (§ 6.1.5). As far as I can tell there isn't much of a reason not to allow Ed25519 certs (if a CA wishes to support them ofc) and there were a few scenarios presented to me where Ed25519 certs would be useful in the context of Tor, which already makes heavy usage of Ed25519 keys. Would there be motivation to change the rules to allow Ed25519 certs, or is there some reason I'm missing as to why they're not allowed? Thanks, Q Misell ________________________________ Any statements contained in this email are personal to the author and are not necessarily the statements of the company unless specifically stated. AS207960 Cyfyngedig, having a registered office at 13 Pen-y-lan Terrace, Caerdydd, Cymru, CF23 9EU, trading as Glauca Digital, is a company registered in Wales under № 12417574<https://e.as207960.net/w4bdyj/xa9BLe6P>, LEI 875500FXNCJPAPF3PD10. ICO register №: ZA782876<https://e.as207960.net/w4bdyj/h2BMZREa>. UK VAT №: GB378323867. EU VAT №: EU372013983. Turkish VAT №: 0861333524. South Korean VAT №: 522-80-03080. AS207960 Ewrop OÜ, having a registered office at Lääne-Viru maakond, Tapa vald, Porkuni küla, Lossi tn 1, 46001, trading as Glauca Digital, is a company registered in Estonia under № 16755226. Estonian VAT №: EE102625532. Glauca Digital and the Glauca logo are registered trademarks in the UK, under № UK00003718474 and № UK00003718468, respectively. _______________________________________________ Servercert-wg mailing list [email protected]<mailto:[email protected]> https://lists.cabforum.org/mailman/listinfo/servercert-wg
_______________________________________________ Servercert-wg mailing list [email protected] https://lists.cabforum.org/mailman/listinfo/servercert-wg
