On 05/06/2024 06:56, John Mattsson wrote:
I think P-384 is the most required of the NIST P-curves.
I've heard that some. Oddly, I use a test server that only supports p384 as a way to trigger HRR when testing ECH, which seems to work for most clients who test with my servers, so I wonder if, when using a hybrid KEM, we're heading to a world where one large set of clients emit x25519 and x25519+pq and another large set emit p256 and p384+pq? I guess if that meant there wasn't a real need for much use of p256+pq that might be a small saving and worth documenting somewhere even if we do define a codepoint for p256+pq. Cheers, S.
OpenPGP_0xE4D8E9F997A833DD.asc
Description: OpenPGP public key
OpenPGP_signature.asc
Description: OpenPGP digital signature
_______________________________________________ TLS mailing list -- tls@ietf.org To unsubscribe send an email to tls-le...@ietf.org
