Re: [quicwg/base-drafts] A small certificate is good (#3825)

[Marten Seemann <[e-mail]>]

@marten-seemann commented on this pull request.



> @@ -651,6 +651,17 @@ verification that the identity of the server is included in a certificate and
 that the certificate is issued by a trusted entity (see for example
 {{?RFC2818}}).
 
+Note:
+
+: Where servers provide certificates for authentication, the size of
+  the certificate chain can consume a large number of bytes.  Controlling the
+  size of certificate chains is critical to performance in QUIC as servers are
+  limited to sending 3 bytes for every byte received prior to validating the
+  client address; see Section 8.1 of {{QUIC-TRANSPORT}}.  The size of a
+  certificate chain can managed by limiting the number of names or extensions;

can be?

> @@ -651,6 +651,17 @@ verification that the identity of the server is included in a certificate and
 that the certificate is issued by a trusted entity (see for example
 {{?RFC2818}}).
 
+Note:
+
+: Where servers provide certificates for authentication, the size of
+  the certificate chain can consume a large number of bytes.  Controlling the
+  size of certificate chains is critical to performance in QUIC as servers are
+  limited to sending 3 bytes for every byte received prior to validating the
+  client address; see Section 8.1 of {{QUIC-TRANSPORT}}.  The size of a
+  certificate chain can managed by limiting the number of names or extensions;
+  using keys with small public key representations, like ECDSA; or, by using

s/or/and/?

> @@ -756,8 +767,8 @@ In TLS over TCP, the HelloRetryRequest feature (see Section 4.1.4 of
 well as for a stateless round-trip check. From the perspective of QUIC, this
 just looks like additional messages carried in Initial packets. Although it is
 in principle possible to use this feature for address verification in QUIC,
-QUIC implementations SHOULD instead use the Retry feature (see Section 8.1 of
-{{QUIC-TRANSPORT}}). HelloRetryRequest is still used to request key shares.
+QUIC implementations SHOULD instead use the Retry feature; see Section 8.1 of

This seems unrelated. Was this supposed to go in #3826?

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/3825#pullrequestreview-442792032