<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class="">
<br class="">
<div>
<blockquote type="cite" class="">
<div class="">On Apr 13, 2022, at 2:07 PM, Bernd Eckenfels <<a href="mailto:ecki@zusammenkunft.net" class="">ecki@zusammenkunft.net</a>> wrote:</div>
<br class="Apple-interchange-newline">
<div class="">
<div class="">
<div dir="ltr" class="">
<div dir="ltr" style="background-color: rgb(255, 255, 255);" class="">Hello,</div>
<div dir="ltr" style="background-color: rgb(255, 255, 255);" class=""><br class="">
</div>
<div dir="ltr" style="background-color: rgb(255, 255, 255);" class="">For multiple connections session- or ticket reuse would be much more efficient. </div>
<div dir="ltr" style="background-color: rgb(255, 255, 255);" class=""><br class="">
</div>
<div dir="ltr" style="background-color: rgb(255, 255, 255);" class="">In fact I think cert compression looks like the wrong solution. Having a immutable certificate download Chain would be a cool alternative solution - especially with future large postquantumcrypto
certificates. That’s also easy to cache.</div>
<div dir="ltr" style="background-color: rgb(255, 255, 255);" class=""><br class="">
</div>
</div>
</div>
</div>
</blockquote>
<div>I agreed, it would be cool as well if the certificate chain could be cached in the DNS record.</div>
<div><br class="">
</div>
<div>Thanks,</div>
<div>Xuelei</div>
<div><br class="">
</div>
<br class="">
<blockquote type="cite" class="">
<div class="">
<div class="">
<div dir="ltr" class="">
<div dir="ltr" style="background-color: rgb(255, 255, 255);" class=""></div>
<div dir="ltr" style="background-color: rgb(255, 255, 255);" class="">(But I recon that’s not for this list to discuss, it’s just an argument against implementing a draft standard)</div>
<div dir="ltr" style="background-color: rgb(255, 255, 255);" class=""><br class="">
</div>
<div dir="ltr" style="background-color: rgb(255, 255, 255);" class=""><br class="">
</div>
<div dir="ltr" style="background-color: rgb(255, 255, 255);" class="">Gruss</div>
<div dir="ltr" style="background-color: rgb(255, 255, 255);" class="">Bernd</div>
<div id="ms-outlook-mobile-signature" class="">
<div style="direction:ltr" class="">-- </div>
<div style="direction:ltr" class=""><a href="http://bernd.eckenfels.net" class="">http://bernd.eckenfels.net</a></div>
</div>
</div>
<hr style="display:inline-block;width:98%" tabindex="-1" class="">
<div id="divRplyFwdMsg" dir="ltr" class=""><font face="Calibri, sans-serif" style="font-size:11pt" class=""><b class="">Von:</b> security-dev <<a href="mailto:security-dev-retn@openjdk.java.net" class="">security-dev-retn@openjdk.java.net</a>> im Auftrag von
Daniel Jeliński <<a href="mailto:djelinski1@gmail.com" class="">djelinski1@gmail.com</a>><br class="">
<b class="">Gesendet:</b> Wednesday, April 13, 2022 10:01:29 PM<br class="">
<b class="">An:</b> xueleifan(XueleiFan) <<a href="mailto:xueleifan@tencent.com" class="">xueleifan@tencent.com</a>><br class="">
<b class="">Cc:</b> OpenJDK Dev list <<a href="mailto:security-dev@openjdk.java.net" class="">security-dev@openjdk.java.net</a>><br class="">
<b class="">Betreff:</b> Re: JEP Review Request: TLS Certificate Compression</font>
<div class=""> </div>
</div>
<div class="BodyFragment"><font size="2" class=""><span style="font-size:11pt;" class="">
<div class="PlainText">I like the idea of implementing certificate compression. Only one<br class="">
concern: TLS handshakes are generally a CPU-intensive operation, and<br class="">
certificate compression / decompression will only make it worse. Will<br class="">
it be possible to compress a certificate once and use it across<br class="">
multiple handshakes? Decompression has to be performed every time,<br class="">
obviously.<br class="">
<br class="">
Regards,<br class="">
Daniel<br class="">
<br class="">
pon., 21 mar 2022 o 16:49 xueleifan(XueleiFan) <<a href="mailto:xueleifan@tencent.com" class="">xueleifan@tencent.com</a>><br class="">
napisał(a):<br class="">
><br class="">
> Hi,<br class="">
><br class="">
><br class="">
> The JDK Enhancement Proposal, TLS Certificate Compression, has been opened for community review. Detailed, please refer to the draft:<br class="">
><br class="">
> <a href="https://bugs.openjdk.java.net/browse/JDK-8281710" class="">https://bugs.openjdk.java.net/browse/JDK-8281710</a><br class="">
><br class="">
> and the discussion of this potential feature at security-dev:<br class="">
><br class="">
> <a href="https://mail.openjdk.java.net/pipermail/security-dev/2022-March/029242.html" class="">
https://mail.openjdk.java.net/pipermail/security-dev/2022-March/029242.html</a><br class="">
><br class="">
><br class="">
> Please feel free to make comments and review the JEP.<br class="">
><br class="">
> Thanks,<br class="">
> Xuelei<br class="">
</div>
</span></font></div>
</div>
</div>
</blockquote>
</div>
<br class="">
</body>
</html>