opentdf/spec

KAS RSA keys should be deprecated in favor of EC keys in the spec

bleggett opened this issue · 0 comments

bleggett commented

  1. Right now, TDF uses an RSA keypair for wrapping.

  2. EC is smaller, faster, and more secure than RSA - TDF should use EC keys, there is no good reason not to.

  3. This would reduce the number of "important keys" in the system that people (and our scripts, and KAS, and hardware modules) have to keep track of.

  4. The biggest practical implementation difference between nanoTDF (which has no public spec) and TDF is the use of EC vs RSA keys - removing this would allow us to simplify our SDK logic, and share more code between the nanoTDF and TDF codepaths, as well as our KAS codepaths.

  5. This would require us to major-version bump the spec, add EC keys, and mark the use of RSA as deprecated - we should not be afraid of doing this.