EdDSA as used in TLS 1.3 imposes a requirement that possibly could be problematic for approaches which try to avoid large buffers: > A bigger issue with the us

EdDSA as used in TLS 1.3 imposes a requirement that possibly could be problematic for approaches which try to avoid large buffers: > A bigger issue with the use of Ed25519 or Ed448 in X.509 certificates is that these signature algorithms use an extra protection against collision attacks on hash functions: the initial hashing is done not on the signed data alone, but on the concatenation of the encoding of the public key and the signed data. This is called “PureEdDSA” in RFC 8032 terminology, and it makes the signature function more resilient against collision attacks, if the hash function turns out to be flaky in that respect (like MD5 or SHA-1). However, it means that the public key must be known before starting to process the signed data. In an X.509 certificate path provided on a stream in usual SSL/TLS order (end-entity first, then CA), the public key is made available only after the whole signed certificate has been received. Verifying a certificate path that involves use of EdDSA keys by CA thus requires buffering a complete certificate in RAM, something which has so far been carefully avoided by BearSSL. https://bearssl.org/tls13.html https://bearssl.org/tls13.html Note that the end-entity certificate for google.com (albeit not using EdDSA) is nearly 4K, largely because the huge list of Subject Alternative Names, and I imagine certificates could easily be larger in many other cases. You need to buffer the entirety of each certificate in the chain plus the initial part of the issuer's certificate, up to the subject public key (that is, the public key of the issuer of the previous certificate). This assumes a certificate chain is received in the optimal order. I think TLS 1.3 actually dispenses with the requirement that a chain be delivered in any specific order, in which case in the worst case you may be stuck having to buffer almost the entire chain.