[prev in list] [next in list] [prev in thread] [next in thread] 

List:       mozilla-crypto
Subject:    Re: Patent-free crypto possible?
From:       Dr Stephen Henson <shenson () drh-consultancy ! demon ! co ! uk>
Date:       1998-12-08 23:04:07
[Download RAW message or body]

Julien Pierre wrote:
> 
> As far as I know, only TLS can support it, and I don't think that it has
> been implemented in any Netscape server yet - or any secure browser. I
> hope that someone will prove me wrong on that.
> 

Thats my understanding too. Netscape browsers support DSA certificates
but not the necessary DH SSL modes for an RSA free SSL.

> SSL 2 and 3 require RSA public/private encryption. On top of that, all
> the certificate authorities out there are setup to sign your server RSA
> keys, and not any other type of key. This means that if you wanted to
> have RSA-free encryption, you would have to have a new generation of
> a) secure web servers
> b) secure web browsers - what you are trying to do
> c) certificate authorities - if you require authentication
> 
> This isn't likely to happen overnight. Unfortunately, it looks like it
> will take longer for the server/browser & CAs to adapt to non-RSA
> encryption than it will take to just wait for the RSA patent to expire.
> 

SSL v3 does not require the use of RSA. There are some modes that use
DSA+DH. The only browser I know that supports this is the HotJava
browser.

Unfortunately there are three mutually incompatible DSA signature
formats used by SSL/TLS (Netscape, SSLeay, Sun) the fact that this
hasn't been sorted out is an indication of how popular RSA free SSL is.

As for CAs I'm a little bit more optimistic. S/MIME v3 will require
mandatory suppport for DSA and DH certificates. This will mean that such
CAs will need to appear if the standard is to be usable (and lots of
vendors are in the mailing list).

Steve.
-- 
Dr Stephen N. Henson. UK based freelance Cryptographic Consultant. 
For info see homepage at http://www.drh-consultancy.demon.co.uk/
Email: shenson@drh-consultancy.demon.co.uk
PGP key: via homepage.

[prev in list] [next in list] [prev in thread] [next in thread]