Raw Public Keys - RFC 7250

Phil Leblanc philanc at gmail.com
Tue Apr 6 18:41:59 BST 2021

Hi All,

Have any of you already used in your clients and servers Raw Public
Keys, as specified in RFC 7250?

It allows to pass raw public keys in a lightweight form of
certificate. The main benefit is of course shorter certificates and
lower parsing cost. With EC key exchange, the "cert" containing only
the public key would be almost as small as the SHA256 of a regular

And it seems that it is well suited to the TOFU approach. (the main
security considerations - section 6 - do not apply with TOFU)

The RFC is already quite old (2014) and it is included in TLS v1.3.

Do you know how supported it is in common TLS libraries?


More information about the Gemini mailing list