[tech] support for Ed25519 in clients

[Stéphane Bortzmeyer]

On Thu, Apr 08, 2021 at 12:33:39AM +0200,
 Johann Galle <johann@qwertqwefsday.eu> wrote 
 a message of 170 lines which said:

> choosing Ed25519 as the default algorithm over ECDSA [1], I have
> received multiple complaints about server operators not being able
> to connect to their own servers because clients seemingly did not
> support this signing algorithm.

Lupa <gemini://gemini.bortzmeyer.org/software/lupa/stats.gmi> shows
that indeed only a small minority of capsules use Ed25519. There is
probably a chicken-and-egg probleme here, since client support, as you
noticed, is poor, which does not motivate capsulemasters.

This is a serious problem for Gemini. Ed25519 in TLS was standardized
in RFC 8410 <gemini://gemini.bortzmeyer.org/rfc-mirror/rfc8410.txt>,
more than two years ago. And of course, it is much older than that, so
all TLS implementations should have it by now. The Web has no such
problem.

Ed25519 has two characteristics:

* not developed inside an "official" agency, which some people believe
a strength, since there was documented evidence of standard
development organizations like NIST tampering with the security of
algorithms, to make surveillance easier,

* widely recognized among cryptographers.

So I do not really see why someone would like to use exotic TLS
libraries without Ed25519.