EdDSA Certificates

Still, I do agree with @wordlesswind's request: I also would like to see support for EdDSA. The ED curves are much better than NIST's in many aspects.

Sadly, the current state is that most implementations don't support EdDSA certificates: I run a test site myself (ed25519-test.germancoding.com) where you can check whether your TLS client accepts these certificates. If you see an error message similar to "NO_CYPHER_OVERLAP" or "CIPHER_MISMATCH" it means that your client does not support EdDSA*, while a standard certificate verification error (untrusted root) probably means that it is supported. If you want to confirm, temporarily trust the root certificate from here (due to BR requirements it's impossible to get a public cert right now).

Once browsers have implemented EdDSA it makes sense to push for allowance in the BRs. But right now the initiative appears to be a bit slow. Still, hopefully requests like this keep the goal alive!

The post-quantum aspect isn't really relevant though: The Cloudflare article you linked talks about Kyber, a post-quantum key encapsulation method (or a hybrid form of it). AFAIK, you can't do post-quantum safe cryptography with neither ECDSA nor EdDSA. In any case, this is talk about key exchange/key agreement, while certificates (where EdDSA comes into play) are all around signatures & authentication - two different animals. If you are worried about quantum algorithms, you will likely want to aim for an entirely different class of algorithms. The current state of the art crypto is often unsuitable for PQ.

*(Modern) OpenSSL does support EdDSA, and probably a bunch of other non-browser implementations. Within the browser world it gets really sparse.

11 Likes