Subject: Re: [Emu] Potential re-establishment of the EMU working group

From: John Mattsson <[email-masked]>
Date: Fri, 22 Dec 2017 18:12:34 +0000

On Dec 21, 2017, Alan DeKok wrote:

>The question I have is whether we can do anything to EAP-TLS to address the issue.  Answering that question >requires a deeper dive into TLS.

In TLS 1.3, ECC is mandatory to support. This drastically reduces the sizes of certificates and signatures (public key sizes from 384 bytes (RSA and DHE) to 32 bytes (ECDHE) and signatures from 384 bytes (RSA) to 64 bytes (ECDSA and EdDSA) ).

Anything for older version of TLS would have to be pure recommendations or guidance to preserve backward compatibility. I think we should update the charter to cover guidance on how to handle large certificates and long certificate chains in EAP-TLS with all versions of TLS. This could be handled in the same bullet as “guidance or update to enable the use of TLS 1.3”.

Cheers,
John

---

From: Alan DeKok <[email-masked]>
Date: Sat, 23 Dec 2017 07:15:41 -0500

> In TLS 1.3, ECC is mandatory to support. This drastically reduces the sizes of certificates and signatures (public key sizes from 384 bytes (RSA and DHE) to 32 bytes (ECDHE) and signatures from 384…

  This doesn't help people with established certificates, business practices, etc.

> Anything for older version of TLS would have to be pure recommendations or guidance to preserve backward compatibility. I think we should update the charter to cover guidance on how to handle large…

  That would definitely be useful.

  Alan DeKok.