Add support for RFC 5349 "Elliptic Curve PKINIT"
- Dominant language
- C#
- Stars
- 567
- Forks
- 109
- PR merge metrics
- No merged PRs in 30d
Description
**Is your feature request related to a problem? Please describe.**
The base PKINIT spec supports straight Diffie Hellman using MODP 2 or 14 parameters. This is inefficient and leads to potential interop problems. ECC support was spec'ed shortly after PKINIT and introduces ECDH for key exchange and certificate signatures. This will have better performance implications as well as better cross-platform support as ECDH is supported in .NET Core.
**Describe the solution you'd like**
Introduce logic into `AsymmetricKerberosCredential` that detects if the client certificate is EC, and force everything into using EC.
Add a new property to the credential that indicates the key exchange should prefer ECDH over DH (should it be default?).
**Additional context**
https://tools.ietf.org/html/rfc5349
Contributor guide
Assessment
This issue has not been assessed yet.