Re: [TLS] DSS with other than SHA-1 algorithms

[Martin Rex <[e-mail]>]

Peter Gutmann wrote:
> 
> "Implemented in the client" != "used" though.  The only hard data that we have
> at the moment, the SSL Observatory, indicates:
> 
> Number of deployed DSA TLS servers with certs chaining to a trusted root: 25
> Number "  " ECC  "  "  ": Zero
> Number "  " RSA  "  "  ": Millions

I believe the EFF slides give a figure of 1.3 million RSA certs issued
under a well-known commercial Root.

There are probably a number of reasons why we are seeing very
few (if any) ECDSA certs issued by commercial CAs.  EC algorithms are
still patent encumbered, and the licensing scheme by the patent holder
was a pay-per-issued-certificate targetting commercial CAs.

The other issue is that there still is an awfully large installed
base which doesn't support such certs--so as long as RSA is still
considered secure, why bother with EC certificates?

There seems to be a preference for ECDSA at NIST.  But there also
was a preference for DSA at NIST, including a bias for the
TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA cipher suite in TLSv1.0
that was completely ignored by the marketplace.


At the time when the not-EC-capable TLS implementations in the
installed base have died off, the current EC-patent issues will
also have evaporated...  :)


-Martin