Consider removing support for P-521 #277
Labels
F2F
security-tracker
Group bringing to attention of security, or tracked by the security Group but not needing response.
A number of user agents intentionally decline to implement P-521, due to the significant performance overheads incurred relative to the limited security benefit provided in practice. For example, both Chrome and Firefox prohibit such certificates within TLS connections.
The current language includes P-521 as optional, as captured at
openscreenprotocol/index.bs
Lines 363 to 371 in 5488c7b
This will likely exacerbate interoperability issues, and also arguably incompatible with the goal stated in Non-Functional Requirements, namely
openscreenprotocol/index.bs
Lines 206 to 210 in 5488c7b
Suggestion: Remove P-521.
The text was updated successfully, but these errors were encountered: