Re: [TLS] consensus to drop non-ECC DSA from TLS 1.3 spec? (was: DSA should die)
Kurt Roeckx <kurt@roeckx.be> Tue, 19 May 2015 21:09 UTC
Return-Path: <kurt@roeckx.be>
X-Original-To: tls@ietfa.amsl.com
Delivered-To: tls@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 87ACA1B3205 for <tls@ietfa.amsl.com>; Tue, 19 May 2015 14:09:37 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: 0.799
X-Spam-Level:
X-Spam-Status: No, score=0.799 tagged_above=-999 required=5 tests=[BAYES_50=0.8, SPF_HELO_PASS=-0.001] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id xVtWDEpeaUyx for <tls@ietfa.amsl.com>; Tue, 19 May 2015 14:09:35 -0700 (PDT)
Received: from defiant.e-webshops.eu (defiant.e-webshops.eu [82.146.122.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 7ECAF1A90BF for <tls@ietf.org>; Tue, 19 May 2015 14:09:35 -0700 (PDT)
Received: from intrepid.roeckx.be (localhost [127.0.0.1]) by defiant.e-webshops.eu (Postfix) with ESMTP id 116DD1C211B; Tue, 19 May 2015 23:09:33 +0200 (CEST)
Received: by intrepid.roeckx.be (Postfix, from userid 1000) id E2C8F1FE014F; Tue, 19 May 2015 23:09:32 +0200 (CEST)
Date: Tue, 19 May 2015 23:09:32 +0200
From: Kurt Roeckx <kurt@roeckx.be>
To: Dave Garrett <davemgarrett@gmail.com>
Message-ID: <20150519210932.GA25790@roeckx.be>
References: <201505191507.31022.davemgarrett@gmail.com>
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Disposition: inline
In-Reply-To: <201505191507.31022.davemgarrett@gmail.com>
User-Agent: Mutt/1.5.23 (2014-03-12)
Archived-At: <http://mailarchive.ietf.org/arch/msg/tls/k3Y3kN8MN3nhcpVJjd0xuaJCQSI>
Cc: tls@ietf.org
Subject: Re: [TLS] consensus to drop non-ECC DSA from TLS 1.3 spec? (was: DSA should die)
X-BeenThere: tls@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." <tls.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/tls>, <mailto:tls-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/tls/>
List-Post: <mailto:tls@ietf.org>
List-Help: <mailto:tls-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/tls>, <mailto:tls-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 19 May 2015 21:09:37 -0000
On Tue, May 19, 2015 at 03:07:30PM -0400, Dave Garrett wrote: > https://www.ietf.org/mail-archive/web/tls/current/msg15773.html > > The topic of completely dropping DSA was brought up a while back, and the WG seemed to be mostly in favor of it. (in favor of using ECDSA instead, if not wanting to use RSA) Cutting it out of the spec would get rid of a fair bit of obsolete text that doesn't need to be there anymore, which would simplify things a bit. Did we ever get to a point where consensus could be called in favor of killing it? The usage of DSA certificates is so low that I know about 4 certificates that didn't expire yet, but haven't seen any for more than a year. Firefox recently (March 31) stopped supporting DSA certificates and I don't know of any problems with that change. So I see no need to support it in TLS 1.3. Kurt
- [TLS] consensus to drop non-ECC DSA from TLS 1.3 … Dave Garrett
- Re: [TLS] consensus to drop non-ECC DSA from TLS … Kurt Roeckx