Re: [TLS] DSS with other than SHA-1 algorithms

[Rob Stradling <[e-mail]>]

On Wednesday 11 May 2011 09:38:33 Peter Gutmann wrote:
> Martin Rex <[e-mail]> writes:
> >There are probably a number of reasons why we are seeing very few (if any)
> >ECDSA certs issued by commercial CAs.  EC algorithms are still patent
> >encumbered, and the licensing scheme by the patent holder was a pay-per-
> >issued-certificate targetting commercial CAs.
> 
> Are the CAs impeded by patents?

The first commercial CA to answer "No" and proceed to issue ECC certs will 
almost certainly end up in court with an expensive legal bill.  Even if the 
correct answer really is "No".

So yes, the CAs are impeded by patents.

> You can do ECC without infringing on any patents, and I would guess the HSMs
> that do use any patented aspects of ECC have already paid their tithe to
> Certicom.

nCipher have paid their tithe:
http://www.certicom.com/index.php/2005-press-releases/35-2005-press-
releases/247-certicom-licenses-intellectual-property-to-ncipher

However, last I heard, nCipher will only grant their HSMs' ECC functionality 
to be enabled for:
  a) customers who are not CAs.
  b) customers who are CAs and who have a suitable CA licence from Certicom.

> >The other issue is that there still is an awfully large installed base
> >which doesn't support such certs--so as long as RSA is still considered
> >secure, why bother with EC certificates?
> 
> I think that's the real reason, use of ECC is essentially a fashion
> statement, and the fact that any use condemns you to Browser Warning Hell

There doesn't have to be Browser Warning Hell.

A server could have an RSA cert and an ECC cert.  When a client advertises 
support for any ECC cipher suites in its "ClientHello" message, the server can 
send its ECC cert in its "Certificate" message.  When a client doesn't 
advertise support for any ECC cipher suites, the server can "fall back" to its 
RSA cert.
I believe that OpenSSL's server code behaves in this way.

Of course, configuring 2 certs would be extra hassle (and possibly extra 
expense) over configuring just 1 cert.  So my guess is that many sites would 
still not bother with ECC certs, even if they were bundled free with paid RSA 
certs.

<snip>

Rob Stradling
Senior Research & Development Scientist
COMODO - Creating Trust Online