4 ms·
THE CABForum just updated its guidelines (in December) and elliptic curve wise only NIST P-256, NIST P-384 and NIST P-521 are accepted. (See https://cabforum.or
by brohee 2y ago
THE CABForum just updated its guidelines (in December) and elliptic curve wise only NIST P-256, NIST P-384 and NIST P-521 are accepted. (See https://cabforum.org/working-groups/server/baseline- https://cabforum.org/working-groups/server/baseline-
requirements/requirements/#615-key-sizes)
So on the general web it seems remote at best.
- throw0101c 2y ago> THE CABForum just updated its guidelines (in December) and elliptic curve wise only NIST P-256, NIST P-384 and NIST P-521 are accepted. NIST P-curve certs were acceptable per the Base Requirements all the way back in 2012 * https://cabforum.org/uploads/Baseline_Requirements_V1_1.pdf https://cabforum.org/uploads/Baseline_Requirements_V1_1.pdf See "Appendix A - Cryptographic Algorithm and Key Requirements (Normative)", (3) Subscriber Certificates.
- brohee 2y agoI'm well aware I should have added a "still" in the sentence somewhere. All efforts to have Ed25519 on the general web seem to run out of steam, we can find https://www.ietf.org/archive/id/draft-moskowitz-eddsa-pki-06.html https://www.ietf.org/archive/id/draft-moskowitz-eddsa-pki-06... IETF side, https://lists.cabforum.org/pipermail/servercert-wg/2024-June/004646.html https://lists.cabforum.org/pipermail/servercert-wg/2024-June... is the last discussion CABforum side. Ed25519 certs do work with TLS (OpenSSL support at least), but without browser adoption it's machine to machine with private CA only .