<html><body><span style="font-family:Verdana; color:#000000; font-size:10pt;"><div>Rob and Rick - thanks, that addresses my concern.</div><div><br></div><div>Thanks,</div><div><br></div><div>Wayne</div><div><br><br></div>
<blockquote id="replyBlockquote" webmail="1" style="border-left: 2px solid blue; margin-left: 8px; padding-left: 8px; font-size:10pt; color:black; font-family:verdana;">
<div id="wmQuoteWrapper">
-------- Original Message --------<br>
Subject: Re: [cabfpub] BR Requirements for 1024-bit Certificates<br>
From: Rob Stradling <<a href="mailto:rob.stradling@comodo.com">rob.stradling@comodo.com</a>><br>
Date: Thu, January 31, 2013 3:46 pm<br>
To: Rick Andrews <<a href="mailto:Rick_Andrews@symantec.com">Rick_Andrews@symantec.com</a>><br>
Cc: "<a href="mailto:public@cabforum.org">public@cabforum.org</a>" <<a href="mailto:public@cabforum.org">public@cabforum.org</a>><br>
<br>
:-)<br>
<br>
On 31/01/13 22:44, Rick Andrews wrote:<br>
> +1<br>
><br>
> Our responses crossed in the mail :^)<br>
><br>
>> -----Original Message-----<br>
>> From: Rob Stradling [<a href="mailto:rob.stradling@comodo.com">mailto:rob.stradling@comodo.com</a>]<br>
>> Sent: Thursday, January 31, 2013 2:43 PM<br>
>> To: <a href="mailto:public@cabforum.org">public@cabforum.org</a><br>
>> Cc: Rick Andrews; Eddy Nigg (StartCom Ltd.)<br>
>> Subject: Re: [cabfpub] BR Requirements for 1024-bit Certificates<br>
>><br>
>> Section "1. Scope" says:<br>
>> "Except where explicitly stated otherwise, these requirements apply<br>
>> only<br>
>> to relevant events that occur on or after the Effective Date."<br>
>><br>
>> For 1024-bit certs that were issued before the Effective Date and which<br>
>> expire after Dec 31st 2013, what "relevant event...on or after the<br>
>> Effective Date" are we talking about that would cause the BRs to become<br>
>> applicable?<br>
>><br>
>> (I wouldn't classify "a cert continues to be both unexpired and<br>
>> unrevoked" as an "event").<br>
>><br>
>> On 31/01/13 22:29, Rick Andrews wrote:<br>
>>> We support changing the date in the BR, as we have tens of thousands<br>
>> of<br>
>>> such certs, many issued long before the BR was enacted. It would be<br>
>>> extremely disruptive to many of our customers to replace them early.<br>
>>><br>
>>> I agree that we don't want to wait until the catastrophe arrives, but<br>
>>> AFAIK the largest number factored was less than 800 bits. Factoring a<br>
>>> 1024-bit number is far, far more difficult. If there is consensus for<br>
>> a<br>
>>> ballot, I would endorse it.<br>
>>><br>
>>> -Rick<br>
>>><br>
>>> *From:<a href="mailto:*public-bounces@cabforum.org">*public-bounces@cabforum.org</a> [mailto:public-<br>
>> <a href="mailto:bounces@cabforum.org">bounces@cabforum.org</a>]<br>
>>> *On Behalf Of *Eddy Nigg (StartCom Ltd.)<br>
>>> *Sent:* Thursday, January 31, 2013 2:12 PM<br>
>>> *To:* <a href="mailto:public@cabforum.org">public@cabforum.org</a><br>
>>> *Subject:* Re: [cabfpub] BR Requirements for 1024-bit Certificates<br>
>>><br>
>>><br>
>>> On 01/31/2013 11:58 PM, From Wayne Thayer:<br>
>>><br>
>>> I'm not yet aware of any known practical brute force attack on 1024<br>
>> bit<br>
>>> RSA keys. On the other hand, it is clear that there will be a major<br>
>>> impact on existing SSL sites as CAs work to rekey 10's of thousands<br>
>> of<br>
>>> certificates this year. I'd like to propose that we extend the<br>
>> deadline<br>
>>> in the BRs for revoking existing certs with 1024 bit keys pending<br>
>>> further evidence of a practical vulnerability. Do others support<br>
>> this<br>
>>> change?<br>
>>><br>
>>><br>
>>> No, at least we don't - those that took steps to ensure adequate keys<br>
>>> sizes in the past were at a disadvantage when refusing to sign<br>
>>> certificate with smaller keys. Today with the BR in place, the same<br>
>>> rules are applied throughout the industry and I don't consider it a<br>
>> good<br>
>>> idea to roll back on this (and other issues) which we finally nailed<br>
>> down.<br>
>>><br>
>>> Additionally we don't have to wait for the catastrophe to arrive in<br>
>>> order to take actions, we really should be at least a half-step<br>
>> ahead.<br>
>>><br>
>>> Finally do I consider a promise to revoke such certificates in<br>
>> December<br>
>>> 2013 not compliant to the BR - and probably also not to some of the<br>
>>> software vendors requirements if I recall correctly. So your<br>
>> statement<br>
>>> is correct, that as of today there shouldn't be any certificates with<br>
>> a<br>
>>> validity of a year and more with 1024 bit keys.<br>
>>><br>
>>> Regards<br>
>>><br>
>>> Signer:<br>
>>><br>
>>><br>
>>><br>
>>> Eddy Nigg, COO/CTO<br>
>>><br>
>>><br>
>>><br>
>>> StartCom Ltd. <<a href="http://www.startcom.org">http://www.startcom.org</a>><br>
>>><br>
>>> XMPP:<br>
>>><br>
>>><br>
>>><br>
>>> <a href="mailto:startcom@startcom.org">startcom@startcom.org</a> <xmpp:<a href="mailto:startcom@startcom.org">startcom@startcom.org</a>><br>
>>><br>
>>> Blog:<br>
>>><br>
>>><br>
>>><br>
>>> Join the Revolution! <<a href="http://blog.startcom.org">http://blog.startcom.org</a>><br>
>>><br>
>>> Twitter:<br>
>>><br>
>>><br>
>>><br>
>>> Follow Me <<a href="http://twitter.com/eddy_nigg">http://twitter.com/eddy_nigg</a>><br>
>>><br>
>>><br>
>>><br>
>>> _______________________________________________<br>
>>> Public mailing list<br>
>>> <a href="mailto:Public@cabforum.org">Public@cabforum.org</a><br>
>>> <a href="https://cabforum.org/mailman/listinfo/public">https://cabforum.org/mailman/listinfo/public</a><br>
>>><br>
>><br>
>> --<br>
>> Rob Stradling<br>
>> Senior Research & Development Scientist<br>
>> COMODO - Creating Trust Online<br>
>> Office Tel: +44.(0)1274.730505<br>
>> Office Fax: +44.(0)1274.730909<br>
>> <a href="http://www.comodo.com">www.comodo.com</a><br>
>><br>
>> COMODO CA Limited, Registered in England No. 04058690<br>
>> Registered Office:<br>
>> 3rd Floor, 26 Office Village, Exchange Quay,<br>
>> Trafford Road, Salford, Manchester M5 3EQ<br>
>><br>
>> This e-mail and any files transmitted with it are confidential and<br>
>> intended solely for the use of the individual or entity to whom they<br>
>> are<br>
>> addressed. If you have received this email in error please notify the<br>
>> sender by replying to the e-mail containing this attachment. Replies to<br>
>> this email may be monitored by COMODO for operational or business<br>
>> reasons. Whilst every endeavour is taken to ensure that e-mails are<br>
>> free<br>
>> from viruses, no liability can be accepted and the recipient is<br>
>> requested to use their own virus checking software.<br>
><br>
<br>
-- <br>
Rob Stradling<br>
Senior Research & Development Scientist<br>
COMODO - Creating Trust Online<br>
Office Tel: +44.(0)1274.730505<br>
Office Fax: +44.(0)1274.730909<br>
<a href="http://www.comodo.com">www.comodo.com</a><br>
<br>
COMODO CA Limited, Registered in England No. 04058690<br>
Registered Office:<br>
3rd Floor, 26 Office Village, Exchange Quay,<br>
Trafford Road, Salford, Manchester M5 3EQ<br>
<br>
This e-mail and any files transmitted with it are confidential and <br>
intended solely for the use of the individual or entity to whom they are <br>
addressed. If you have received this email in error please notify the <br>
sender by replying to the e-mail containing this attachment. Replies to <br>
this email may be monitored by COMODO for operational or business <br>
reasons. Whilst every endeavour is taken to ensure that e-mails are free <br>
from viruses, no liability can be accepted and the recipient is <br>
requested to use their own virus checking software.<br>
_______________________________________________<br>
Public mailing list<br>
<a href="mailto:Public@cabforum.org">Public@cabforum.org</a><br>
<a href="https://cabforum.org/mailman/listinfo/public">https://cabforum.org/mailman/listinfo/public</a><br>
</div>
</blockquote></span></body></html>