<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
        {font-family:"Cambria Math";
        panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
        {font-family:Calibri;
        panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
        {font-family:Tahoma;
        panose-1:2 11 6 4 3 5 4 4 2 4;}
@font-face
        {font-family:Byington;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
        {margin:0in;
        margin-bottom:.0001pt;
        font-size:12.0pt;
        font-family:"Times New Roman","serif";}
a:link, span.MsoHyperlink
        {mso-style-priority:99;
        color:blue;
        text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
        {mso-style-priority:99;
        color:purple;
        text-decoration:underline;}
span.EmailStyle17
        {mso-style-type:personal-reply;
        font-family:"Calibri","sans-serif";
        color:#1F497D;}
.MsoChpDefault
        {mso-style-type:export-only;
        font-family:"Calibri","sans-serif";}
@page WordSection1
        {size:8.5in 11.0in;
        margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
        {page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">Sorry, we cannot provide a date for the patch at this time. I will update the forum on its availability as soon as I can.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">Kelvin<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><b><span style="font-size:11.0pt;font-family:"Calibri","sans-serif"">From:</span></b><span style="font-size:11.0pt;font-family:"Calibri","sans-serif""> public-bounces@cabforum.org [mailto:public-bounces@cabforum.org]
<b>On Behalf Of </b>GlobalSign(Yasuyuki Inui)<br>
<b>Sent:</b> Wednesday, April 16, 2014 1:43 PM<br>
<b>To:</b> Public@cabforum.org<br>
<b>Subject:</b> Re: [cabfpub] Microsoft SHA-1 deprecation problem for Kernel Mode Code Signing<o:p></o:p></span></p>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<div>
<p class="MsoNormal">Hi Tom-san<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Can you give me the estimate for this patch if you pssible?<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">thanks<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">inui<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">GlobalSign<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-bottom:12.0pt"><o:p> </o:p></p>
<div>
<p class="MsoNormal">2014-04-10 22:06 GMT-04:00 Richard@WoSign <<a href="mailto:richard@wosign.com" target="_blank">richard@wosign.com</a>>:<o:p></o:p></p>
<blockquote style="border:none;border-left:solid #CCCCCC 1.0pt;padding:0in 0in 0in 6.0pt;margin-left:4.8pt;margin-right:0in">
<div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-family:Byington;color:blue;mso-fareast-language:ZH-CN">Yes, our test is the Kernel mode don’t support SHA2 cert.</span><span style="mso-fareast-language:ZH-CN"><o:p></o:p></span></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-family:Byington;color:blue;mso-fareast-language:ZH-CN"> </span><span style="mso-fareast-language:ZH-CN"><o:p></o:p></span></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;text-align:justify">
<span style="font-size:10.5pt;font-family:"Calibri","sans-serif";color:blue;mso-fareast-language:ZH-CN"> </span><span style="mso-fareast-language:ZH-CN"><o:p></o:p></span></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;text-align:justify">
<span style="font-size:10.5pt;font-family:"Calibri","sans-serif";color:blue;mso-fareast-language:ZH-CN">Best Regards,</span><span style="mso-fareast-language:ZH-CN"><o:p></o:p></span></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;text-align:justify">
<span style="font-size:10.5pt;font-family:"Calibri","sans-serif";color:blue;mso-fareast-language:ZH-CN"> </span><span style="mso-fareast-language:ZH-CN"><o:p></o:p></span></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;text-align:justify">
<b><span style="font-family:"Calibri","sans-serif";color:blue;mso-fareast-language:ZH-CN">Richard</span></b><span style="mso-fareast-language:ZH-CN"><o:p></o:p></span></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-family:Byington;color:blue;mso-fareast-language:ZH-CN"> </span><span style="mso-fareast-language:ZH-CN"><o:p></o:p></span></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif";mso-fareast-language:ZH-CN">From:</span></b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif";mso-fareast-language:ZH-CN">
<a href="mailto:public-bounces@cabforum.org" target="_blank">public-bounces@cabforum.org</a> [mailto:<a href="mailto:public-bounces@cabforum.org" target="_blank">public-bounces@cabforum.org</a>]
<b>On Behalf Of </b>GlobalSign(Yasuyuki Inui)<br>
<b>Sent:</b> Friday, April 11, 2014 9:15 AM<br>
<b>To:</b> <a href="mailto:Public@cabforum.org" target="_blank">Public@cabforum.org</a><br>
<b>Subject:</b> Re: [cabfpub] Microsoft SHA-1 deprecation problem for Kernel Mode Code Signing</span><span style="mso-fareast-language:ZH-CN"><o:p></o:p></span></p>
<div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="mso-fareast-language:ZH-CN"> <o:p></o:p></span></p>
<div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="mso-fareast-language:ZH-CN">Hi Tom-san<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="mso-fareast-language:ZH-CN"> <o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="mso-fareast-language:ZH-CN">this patch (sha2 codesign for kernel mode on vista and win7) is already released?<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="mso-fareast-language:ZH-CN">our costumer seems encounter this problem but I am not sure exact reason.<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="mso-fareast-language:ZH-CN"> <o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="mso-fareast-language:ZH-CN">thanks<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="mso-fareast-language:ZH-CN"> <o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="mso-fareast-language:ZH-CN">inui <o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="mso-fareast-language:ZH-CN">GlobalSign<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="mso-fareast-language:ZH-CN"> <o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="mso-fareast-language:ZH-CN"> <o:p></o:p></span></p>
<div>
<blockquote style="border:none;border-left:solid windowtext 1.0pt;padding:0in 0in 0in 6.0pt;margin-left:4.8pt;margin-top:5.0pt;margin-right:0in;margin-bottom:5.0pt;border-color:currentColor currentColor currentColor rgb(204,204,204)">
<div>
<div>
<blockquote style="border:none;border-left:solid windowtext 1.0pt;padding:0in 0in 0in 6.0pt;margin-left:4.8pt;margin-top:5.0pt;margin-right:0in;margin-bottom:5.0pt;border-color:currentColor currentColor currentColor rgb(204,204,204)">
<p class="MsoNormal" style="mso-margin-top-alt:auto;margin-bottom:12.0pt"><span style="mso-fareast-language:ZH-CN"><br>
On 13/11/2013 17:43, "Tom Albertson" <<a href="mailto:tomalb@microsoft.com" target="_blank">tomalb@microsoft.com</a>> wrote:<br>
<br>
>Hi Rob,<br>
><br>
>Yes, we are making changes to supported Windows versions to support SHA-2<br>
>for kernel mode code signing.  The patch will come out publicly, and we<br>
>will notify kernel mode CAs about the expected timeframe and overall kmod<br>
>strategy.<br>
><br>
>Tom<br>
><br>
>-----Original Message-----<br>
>From: Rob Stradling [mailto:<a href="mailto:rob.stradling@comodo.com" target="_blank">rob.stradling@comodo.com</a>]<br>
>Sent: Wednesday, November 13, 2013 4:18 AM<br>
>To: Tom Albertson; Kelvin Yiu<br>
>Cc: <a href="mailto:public@cabforum.org" target="_blank">public@cabforum.org</a><br>
>Subject: Microsoft SHA-1 deprecation problem for Kernel Mode Code Signing<br>
><br>
>Tom, Kelvin,<br>
><br>
>I know you're already aware that Windows Vista and Windows 7 are unable<br>
>to use SHA-2 certificates for Kernel Mode Code Signing.<br>
><br>
>Your SHA-1 deprecation advisory [1] says:<br>
>"Recommendation: Microsoft recommends that certificate authorities no<br>
>longer sign newly generated certificates using the SHA-1 hashing<br>
>algorithm and begin migrating to SHA-2. Microsoft also recommends that<br>
>customers replace their SHA-1 certificates with SHA-2 certificates at the<br>
>earliest opportunity."<br>
><br>
>I understand this to mean that, ideally, you'd like us to switch from<br>
>SHA-1 to SHA-2 _today_, for the issuance of new SSL certificates and Code<br>
>Signing Certificates.<br>
><br>
>Does this mean that you've managed to hotfix all deployed Vista/7 boxes<br>
>on the planet, so that SHA-2 certificates can now be used for Kernel Mode<br>
>Code Signing?<br>
><br>
>If not, how do you intend to address this issue?<br>
><br>
>(I presume you're not phasing out Windows 7 at the same time as phasing<br>
>out SHA-1!!)<br>
><br>
><br>
>[1] <a href="https://technet.microsoft.com/en-us/security/advisory/2880823" target="_blank">
https://technet.microsoft.com/en-us/security/advisory/2880823</a><br>
><br>
>--<br>
>Rob Stradling<br>
>Senior Research & Development Scientist<br>
>COMODO - Creating Trust Online<br>
><br>
>_______________________________________________<br>
>Public mailing list<br>
><a href="mailto:Public@cabforum.org" target="_blank">Public@cabforum.org</a><br>
><a href="https://cabforum.org/mailman/listinfo/public" target="_blank">https://cabforum.org/mailman/listinfo/public</a><o:p></o:p></span></p>
</blockquote>
</div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="mso-fareast-language:ZH-CN"> <o:p></o:p></span></p>
</div>
</blockquote>
</div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="mso-fareast-language:ZH-CN"> <o:p></o:p></span></p>
</div>
</div>
</div>
</div>
</div>
</div>
</blockquote>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</div>
</div>
</body>
</html>