Re: [quicwg/base-drafts] A small certificate is good (#3825)

[Martin Thomson <[e-mail]>]

@martinthomson commented on this pull request.



> @@ -651,6 +651,17 @@ verification that the identity of the server is included in a certificate and
 that the certificate is issued by a trusted entity (see for example
 {{?RFC2818}}).
 
+Note:
+
+: Where servers provide certificates for authentication, the size of
+  the certificate chain can consume a large number of bytes.  Controlling the
+  size of certificate chains is critical to performance in QUIC as servers are
+  limited to sending 3 bytes for every byte received prior to validating the
+  client address; see Section 8.1 of {{QUIC-TRANSPORT}}.  The size of a
+  certificate chain can managed by limiting the number of names or extensions;
+  using keys with small public key representations, like ECDSA; or, by using

I think that a logical OR is sufficient here.  Though nothing stops someone from doing more than one, and maybe there are things that mean you need to (like being unwilling to reduce the number of cnames on certificates for $reasons.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/pull/3825#discussion_r450005983