[x509] Request: Support EC private keys. about core

[zeroXten]

Thanks for the feedback :)

Are you referring to the management protocol keys, the X.509 keys or both? The plan for x.509 was to be ECDSA by default but hadn't decided about the management protocol yet. As it works more like GPG than TLS, the only real advantage of EC is smaller key sizes. No reason to use it in terms of PFS.

Edit:

Hah. Just noticed you already prefixed it with x509, but would still like your opinion on the management protocol.

[jonbonazza]

As you guessed, I was referring to x.509. =)

If you plan to use ECDSA that's fantastic.
There are a couple advantages of EC keys over RSA keys:

1. As you mentioned, smaller key size. In order to get the strength of 128 bit security, an EC key only needs to be 256-bit, while an RSA key would need to be 3072-bit. In today's world, one could argue that is fine, but in the (nearish?) future, when 256-bit security is the norm, an EC key would only need to be 512-bit, while an equivalent RSA key would need to be... well, over 15,000-bit. That's just simply not scalable.

2. EC is signature algorithm agnostic. That is, while the most common implementation is ECDSA, it can be used with other signature algorithms as well. RSA keys can only be used for RSA signing.

The second point isn't a huge concern for me (and I imagine most people would agree) as ECDSA is sufficient for most uses, but the first point is very important. I see 256-bit encryption becoming the norm within the next 10 years and as important scalability is in todays systems, It would be nice to see projects thinking ahead in this regard. It's also very trivial to implement in Go, so I don't see a downside at all.

As for the management protocol, I still haven't looked much into that portion of things, so I'll reserve my judgement until I have a clearer understanding of how that is intended to work.

[jonbonazza]

I am actually working on an implementation for this. I will submit a PR when ready.

[jonbonazza]

Closing this as we now have more granular issues for this.