On 01/02/2014 12:35 PM, Dr. Stephen Henson wrote: > That's just TLS. To add more complete support to OpenSSL including storing > private keys in PEM files and public keys in case we ever use it in ECDH > certificates it needs an OID and some details on how the keys are encoded.
But ECDHE doesn't need any of these trappings, as nice as they would be
to have. The curves are known; implementations of them are known;
secret keys can be held in memory in any standard way, and public keys
can be transmitted on the wire for the key exchange as simply as
possible, without specifying PKCS encodings or SPKI or whatever.
Getting Curve25519 (and Curve3617?) functional for ECDHE would be a
demonstrably good thing on its own, and it would be a shame for that
functionality to wait until people could finally agree on how to use
PKCS encodings and EdDSA for X.509 certificates.
--dkg
signature.asc
Description: OpenPGP digital signature
