<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><meta http-equiv=Content-Type content="text/html; charset=utf-8"><meta name=Generator content="Microsoft Word 14 (filtered medium)"><!--[if !mso]><style>v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style><![endif]--><style><!--
/* Font Definitions */
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
@font-face
{font-family:Verdana;
panose-1:2 11 6 4 3 5 4 4 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman","serif";
color:black;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p.MsoAcetate, li.MsoAcetate, div.MsoAcetate
{mso-style-priority:99;
mso-style-link:"Texto de globo Car";
margin:0cm;
margin-bottom:.0001pt;
font-size:8.0pt;
font-family:"Tahoma","sans-serif";
color:black;}
span.EstiloCorreo17
{mso-style-type:personal-reply;
font-family:"Calibri","sans-serif";
color:#1F497D;}
span.TextodegloboCar
{mso-style-name:"Texto de globo Car";
mso-style-priority:99;
mso-style-link:"Texto de globo";
font-family:"Tahoma","sans-serif";
color:black;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:70.85pt 3.0cm 70.85pt 3.0cm;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]--></head><body bgcolor=white lang=ES link=blue vlink=purple><div class=WordSection1><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>Agree with Eddy. It will happen the same that occured with the EV, that when the end date came, some CAs were still using 1K lenght certs, after a year as we discussed in the last Scottsdale meeting. <o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'><o:p> </o:p></span></p><div><p class=MsoNormal style='line-height:9.75pt'><b><span lang=ES-TRAD style='font-size:8.5pt;font-family:"Tahoma","sans-serif"'><o:p> </o:p></span></b></p><p class=MsoNormal style='line-height:9.75pt'><b><span lang=ES-TRAD style='font-size:8.5pt;font-family:"Tahoma","sans-serif"'>Iñigo Barreira</span></b><span lang=ES-TRAD style='font-size:8.5pt;font-family:"Tahoma","sans-serif"'><br>Responsable del Área técnica<br><a href="mailto:i-barreira@izenpe.net">i-barreira@izenpe.net</a><o:p></o:p></span></p><p class=MsoNormal><span lang=ES-TRAD style='font-size:8.5pt;font-family:"Tahoma","sans-serif"'>945067705</span><span lang=ES-TRAD style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'><o:p></o:p></span></p><p class=MsoNormal><span lang=ES-TRAD style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'><img border=0 width=585 height=111 id="Imagen_x0020_1" src="cid:image001.png@01CE0058.EB068C40"></span><span lang=ES-TRAD style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'><o:p></o:p></span></p><p class=MsoNormal style='line-height:9.75pt'><span style='font-size:7.5pt;font-family:"Tahoma","sans-serif";color:#888888;mso-fareast-language:ES-TRAD'>ERNE! Baliteke mezu honen zatiren bat edo mezu osoa legez babestuta egotea. Mezua badu bere hartzailea. Okerreko helbidera heldu bada (helbidea gaizki idatzi, transmisioak huts egin) eman abisu igorleari, korreo honi erantzuna. KONTUZ!</span><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#888888;mso-fareast-language:ES-TRAD'><br></span><span style='font-size:7.5pt;font-family:"Tahoma","sans-serif";color:#888888;mso-fareast-language:ES-TRAD'>ATENCION! Este mensaje contiene informacion privilegiada o confidencial a la que solo tiene derecho a acceder el destinatario. Si usted lo recibe por error le agradeceriamos que no hiciera uso de la informacion y que se pusiese en contacto con el remitente.</span><span style='font-family:"Calibri","sans-serif";color:navy;mso-fareast-language:ES-TRAD'><o:p></o:p></span></p></div><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'><o:p> </o:p></span></p><div><div style='border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0cm 0cm 0cm'><p class=MsoNormal><b><span style='font-size:10.0pt;font-family:"Tahoma","sans-serif";color:windowtext'>De:</span></b><span style='font-size:10.0pt;font-family:"Tahoma","sans-serif";color:windowtext'> public-bounces@cabforum.org [mailto:public-bounces@cabforum.org] <b>En nombre de </b>Eddy Nigg (StartCom Ltd.)<br><b>Enviado el:</b> jueves, 31 de enero de 2013 23:12<br><b>Para:</b> public@cabforum.org<br><b>Asunto:</b> Re: [cabfpub] BR Requirements for 1024-bit Certificates<o:p></o:p></span></p></div></div><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal><br>On 01/31/2013 11:58 PM, From Wayne Thayer: <o:p></o:p></p><div><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Verdana","sans-serif"'><o:p> </o:p></span></p><div><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Verdana","sans-serif"'>I'm not yet aware of any known practical brute force attack on 1024 bit RSA keys. On the other hand, it is clear that there will be a major impact on existing SSL sites as CAs work to rekey 10's of thousands of certificates this year. I'd like to propose that we extend the deadline in the BRs for revoking existing certs with 1024 bit keys pending further evidence of a practical vulnerability. Do others support this change?<o:p></o:p></span></p></div></div><p class=MsoNormal style='margin-bottom:12.0pt'><br>No, at least we don't - those that took steps to ensure adequate keys sizes in the past were at a disadvantage when refusing to sign certificate with smaller keys. Today with the BR in place, the same rules are applied throughout the industry and I don't consider it a good idea to roll back on this (and other issues) which we finally nailed down.<br><br>Additionally we don't have to wait for the catastrophe to arrive in order to take actions, we really should be at least a half-step ahead.<br><br>Finally do I consider a promise to revoke such certificates in December 2013 not compliant to the BR - and probably also not to some of the software vendors requirements if I recall correctly. So your statement is correct, that as of today there shouldn't be any certificates with a validity of a year and more with 1024 bit keys.<br><br><o:p></o:p></p><div><table class=MsoNormalTable border=0 cellspacing=0 cellpadding=0><tr><td colspan=2 style='padding:0cm 0cm 0cm 0cm'><p class=MsoNormal>Regards <o:p></o:p></p></td></tr><tr><td colspan=2 style='padding:0cm 0cm 0cm 0cm'><p class=MsoNormal> <o:p></o:p></p></td></tr><tr><td style='padding:0cm 0cm 0cm 0cm'><p class=MsoNormal>Signer: <o:p></o:p></p></td><td style='padding:0cm 0cm 0cm 0cm'><p class=MsoNormal>Eddy Nigg, COO/CTO<o:p></o:p></p></td></tr><tr><td style='padding:0cm 0cm 0cm 0cm'><p class=MsoNormal> <o:p></o:p></p></td><td style='padding:0cm 0cm 0cm 0cm'><p class=MsoNormal><a href="http://www.startcom.org">StartCom Ltd.</a><o:p></o:p></p></td></tr><tr><td style='padding:0cm 0cm 0cm 0cm'><p class=MsoNormal>XMPP: <o:p></o:p></p></td><td style='padding:0cm 0cm 0cm 0cm'><p class=MsoNormal><a href="xmpp:startcom@startcom.org">startcom@startcom.org</a><o:p></o:p></p></td></tr><tr><td style='padding:0cm 0cm 0cm 0cm'><p class=MsoNormal>Blog: <o:p></o:p></p></td><td style='padding:0cm 0cm 0cm 0cm'><p class=MsoNormal><a href="http://blog.startcom.org">Join the Revolution!</a><o:p></o:p></p></td></tr><tr><td style='padding:0cm 0cm 0cm 0cm'><p class=MsoNormal>Twitter: <o:p></o:p></p></td><td style='padding:0cm 0cm 0cm 0cm'><p class=MsoNormal><a href="http://twitter.com/eddy_nigg">Follow Me</a><o:p></o:p></p></td></tr><tr><td colspan=2 style='padding:0cm 0cm 0cm 0cm'><p class=MsoNormal> <o:p></o:p></p></td></tr></table></div><p class=MsoNormal><o:p> </o:p></p></div></body></html>