Re: [saag] post-X509 cryptographic identities

[Stephen Farrell <[e-mail]>]

On 12/02/2020 00:51, Eric Rescorla wrote:
> Well, I see what you say at the end, but I don't understand it. In TLS 1.3,
> key establishment does not involve the cert, which is used for
> authentication. 

Sure. And in a PQ world one might worry about factorisation
and propose unwise changes to x.509 that involve >1 alg in
the certificate signature and SPKI fields. My main point is
that I think that'd be unwise. (Not so much because of TLS
details, but more because of x.509 library details.)

It'd be similarly unwise to want to try handle public keys
for PQC KEMs via x.509 and given the entire world is not
yet on TLS1.3, that'd maybe still be a bit of an issue.

Cheers,
S.