Re: [TLS] DSS with other than SHA-1 algorithms

[Peter Gutmann <[e-mail]>]

Martin Rex <[e-mail]> writes:

>There are probably a number of reasons why we are seeing very few (if any)
>ECDSA certs issued by commercial CAs.  EC algorithms are still patent
>encumbered, and the licensing scheme by the patent holder was a pay-per-
>issued-certificate targetting commercial CAs.

Are the CAs impeded by patents?  You can do ECC without infringing on any
patents, and I would guess the HSMs that do use any patented aspects of ECC
have already paid their tithe to Certicom.

>The other issue is that there still is an awfully large installed base which
>doesn't support such certs--so as long as RSA is still considered secure, why
>bother with EC certificates?

I think that's the real reason, use of ECC is essentially a fashion statement,
and the fact that any use condemns you to Browser Warning Hell makes it a very
expensive one.  The one upside to this is that after six years we still have
next to no (public) deployed base to potentially cause problems, so it's still
possible to fix issues without breaking lots of things.

Peter.