<html> <head> <meta content="text/html; charset=ISO-8859-1" http-equiv="Content-Type"> </head> <body bgcolor="#FFFFFF" text="#000000"> On 09/18/2013 01:53 PM, mees virk wrote: <blockquote cite="mid:DUB126-W4591B623996CB3C7046EDC4200@phx.gbl" type="cite"> <style></style> <div dir="ltr">I do not have a valid support contract, or other contracts with RedHat. Doesn't that stop me from opening proper RFE ticket?<br> <br> In any case, my interest was this time solely for evaluation purposes. If I were actively choosing an integrated identity management product, I might not choose Freeipa because it takes the longevity of the product and the development stance (lack of roadmap?) into question.<br> </div> </blockquote> <br> I wonder where the lack of roadmap came from?<br> <a class="moz-txt-link-freetext" href="http://www.freeipa.org/page/Roadmap">http://www.freeipa.org/page/Roadmap</a><br> So the trac system we use gives a good view of the dynamics of the project<br> <a class="moz-txt-link-freetext" href="https://fedorahosted.org/freeipa/roadmap">https://fedorahosted.org/freeipa/roadmap</a><br> <br> However IMO disconnect in expectations is that support of the ECC is not exactly FreeIPA's problem (yet).<br> It needs to be implemented by the lower levels of the stack first: NSS, Dogtag etc.<br> We have plans for support of the certs for users and we understand that RSA becomes outdated.<br> Your RFE would allow us to track your specific requirements and interest (and make it our problem).<br> <br> Right now the position is that: let the underlying components grow ECC suppoirt and consume this functionality in FreeIPA when it matures.<br> Filing an RFE would change this dynamics and would signal us that there is interest in the community in the actual end point solution, i.e. FreeIPA supporting ECC.<br> <br> Thanks!<br> <br> <blockquote cite="mid:DUB126-W4591B623996CB3C7046EDC4200@phx.gbl" type="cite"> <div dir="ltr"><br> RSA is slowly getting into slippery slope, because it really isn't about what it's worth today. When you protect something with a cryptographic algorithm you have to take account for how long certain types of data will be stored, and factor that time frame in. Increasing the key sizes will not be solution, because several embedded devices such as VPN products, smartcards and RFID devices will start failing pretty fast after 1024-2048 bit keys. <br> <br> ECC was designed to solve some of these issues; it's important development not mostly because of security today but because it will scale better up (it was designed to be implementable better on hardware), and the key sizes start from nicer point of security vs size. So it's the feature that would future proof the CA. At this moment there is available ECC support on some products on all the areas such as smart cards, so the products not having that option out of the box will start basically losing in the competition.<br> <br> I'm not trying to make a technical point here (if I made some minor error there, sorry) but a managerial, and from product management viewpoint. ECC must be on the feature set, or the CA features will be discarded in the future by potential users. That means the Freeipa as a whole might not be selected for some projects. Plus, it doesn't really hurt having ECC in. :)<br> <br> <div> <hr id="stopSpelling"><br> <blockquote cite="mid:BLU175-W8A99B5A6A8731F6FC5E1FC4260@phx.gbl"> <div dir="ltr"> <br> </div> </blockquote> IPA uses NSS, NSS support of ECC algorithms is very fresh, we have not looked at this area yet.<br> I suspect it would require changes in Dogtag first.<br> <br> Would be best if you can file and RFE ticket, then we would be able to follow up.<br> <br> <blockquote cite="mid:BLU175-W8A99B5A6A8731F6FC5E1FC4260@phx.gbl"> <div dir="ltr"> </div> <br> </blockquote> </div> </div> </blockquote> <br> <br> <pre class="moz-signature" cols="72">-- Thank you, Dmitri Pal Sr. Engineering Manager for IdM portfolio Red Hat Inc. ------------------------------- Looking to carve out IT costs? <a class="moz-txt-link-abbreviated" href="http://www.redhat.com/carveoutcosts/">www.redhat.com/carveoutcosts/</a> </pre> </body> </html>