Rob Stradling wrote, On 2009-01-14 03:24 PST: > To the NSS developers: If there existed a standardized certificate > extension in which a CA could put additional signatures using different > algorithms, do you think you'd consider adding support for it to NSS?
Yes, I think the NSS team would consider it, if it really was a standard, at least an IETF RFC. > If yes, might you do this before it was widely supported by CAs, or do > you think you'd wait for the majority of CAs to start using it first? I think that largely depends on who does the work. If someone contributed a patch to NSS that implemented it, and was quite complete (including changes to test tools and test scripts), and didn't require much work at all to go in, I think it might go in basically as soon as it was standard. The contribution of the Japanese Camellia cipher was an example of a very well done contribution that went right in. But if the NSS must develop it, or if a contributed patch is incomplete or requires a lot of work that the contributor is unwilling or unable to do, then prioritizing and scheduling that work involves factors such as the priorities of the sponsors of NSS development. Looking at the new developments in standards of the last few years, we see a list of standardized features that are thought to be important by various members of the crypto community, but which are not yet available in NSS. To name just a few, there are TLS 1.2, AES GCM, OCSP stapling, server support for SNI. Together they constitute a pretty large back log of development waiting to be done. Another new proposal would contend with those for resources. Not all of the features that have been added to NSS in the last few years have been widely adopted by the applications that use NSS. Consequently, the sponsors are now evaluating possible future developments based on their projections for the demand of application developers for those features. I think that says that if they see a groundswell of demand from the application developers for a new feature such as multiple signatures in a certificate, they might go for it, but otherwise, it is likely to languish, IMO. _______________________________________________ dev-tech-crypto mailing list dev-tech-crypto@lists.mozilla.org https://lists.mozilla.org/listinfo/dev-tech-crypto
