Re: [rtcweb] Security architecture: Making ECDSA mandatory

In my search for status on ECDSA (we're in the process of switching the
Chrome default), I came across this in the current draft:

   All implementations MUST implement DTLS 1.0, with the cipher suite
   TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA and the DTLS-SRTP protection
   profile SRTP_AES128_CM_HMAC_SHA1_80.  Implementations SHOULD
   implement DTLS 1.2 with the TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
   cipher suite.  Implementations SHOULD favor cipher suites which
   support PFS over non-PFS cipher suites and GCM over CBC cipher
   suites.  [[OPEN ISSUE: Should we require ECDSA?  Waiting for WG
   Consensus.]]

I also found Martin's PR. It's 11 months old, still open.

Can we merge this now?

On 06/13/2015 12:06 AM, Martin Thomson wrote:
> I've opened https://github.com/rtcweb-wg/security-arch/pull/33
>
> This changes the MTI cipher suites to ECDSA and does a little cleanup
> on the corresponding API requirements to more closely match what has
> just landed in the W3C specification.
>
> We discussed ECDSA and the only concerns raised were with
> compatibility.  I've done some testing with other implementations with
> no issues, and ECDSA seems to be well supported on all those
> hard-to-upgrade PSTN gateways (thanks to Cullen and Ethan for helping
> out with checks there and to NIST for creating certification pressure
> with FIPS-2).
>
> I have an implementation that switches Firefox to ECDSA with P-256 by
> default.  It's much, much faster.  http://bench.cr.yp.to/ claims that
> it's 150 times faster on mobile devices for keygen.
>
> _______________________________________________
> rtcweb mailing list
> rtcweb@ietf.org
> https://www.ietf.org/mailman/listinfo/rtcweb