[Rats] Re: I-D Action: draft-ietf-rats-ear-04.txt

[Thomas Fossati <[e-mail]>]

hi Nathanael,

On Mon, 8 Jun 2026 at 10:52, Nathanael Ritz <[e-mail]> wrote:
> [...]
> How much extra burden will adding COSE_Key support create compared to the performance gains at large scales? Is throughput performance a factor here

I don't think performance/size is a critical criterion here.  (At
least not in the scenario I am familiar with.)
Note also that we can't introduce COSE_Key without also introducing
JWK because of the double encoding of EAR/EAT.
This means that, besides the RP having to support two (albeit pretty
similar) key formats (instead of one, SPKI), the encoding overhead
cannot always be minimal.

> or is it more about someone with COSE whatever support already at hand feeling annoyed 5 years from now when they have to maintain tooling to parse a legacy SPKI formatted key?

I don't think RFC 7468 encodings will be considered legacy anytime soon.
There is simply too much infrastructure that relies on those.
And therefore, I do not think the associated tooling will become
unmaintained in the foreseeable future.

This is one case where "old/ancient" has a positive connotation, as it
implies universal support across all crypto stacks.
Unfortunately, the same can't be said for JWKs, let alone COSE_keys.

> I think Henk has already provided other parallel examples of work that supports COSE_Key, but does the WG have implementation feedback on how much they like or don't like having to provide support?
>
> Do we have any further data here beyond (with deep apologies) "implementation ergonomics philosophy", for lack of a better term?

We can easily compare the encoding overhead, which I believe would
show COSE_KEY << JWK < PEM, at least for raw public keys. (When cert
and cert chains come into the picture, the delta would be less
conspicuous.)
And/or we could build a feature support checklist across crypto
stacks, which I believe would show the exact opposite result.
Would taking the time to compile those help us make a decision?  What
would we learn that we don't already know?

cheers, t