<div dir="ltr">Hi Kirk,<div><br></div><div>In order to help avoid fragmenting this discussion in multiple forums or threads, I've replied to the proposal and hope you can do the same.</div></div><div class="gmail_extra"><br><br><div class="gmail_quote">On Tue, Sep 2, 2014 at 8:33 AM, <a href="mailto:kirk_hall@trendmicro.com">kirk_hall@trendmicro.com</a> <span dir="ltr"><<a href="mailto:kirk_hall@trendmicro.com" target="_blank">kirk_hall@trendmicro.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div lang="EN-US" link="blue" vlink="purple">
<div>
<p class="MsoNormal">Ryan, this recent article in ZDNet about Chrome’s deprecation of SHA-1 raises doubt about when the deprecation will occur – Chrome 39 or later. See excerpts below, which say the implementation date is still under “active review and discussion.”<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal"><a href="http://www.zdnet.com/google-accelerates-end-of-sha-1-support-certificate-authorities-nervous-7000033159/" target="_blank">http://www.zdnet.com/google-accelerates-end-of-sha-1-support-certificate-authorities-nervous-7000033159/</a>
<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">Obviously the implementation date is of enormous importance to our customers – especially if the actual implementation date will come after the new year. We are all working on our messaging now, and would like to get it right.<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">Can you let us know if the date will be after Chrome v39?<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">Thanks.<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal"><b><i><span style="font-size:14.0pt;font-family:"Bradley Hand ITC";color:#0f243e">Kirk R. Hall<u></u><u></u></span></i></b></p>
<p class="MsoNormal">Operations Director, Trust Services<u></u><u></u></p>
<p class="MsoNormal">Trend Micro<u></u><u></u></p>
<p class="MsoNormal"><a href="tel:%2B1.503.753.3088" value="+15037533088" target="_blank">+1.503.753.3088</a><u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal" style="background:white;vertical-align:baseline"><b>[Excerpts from ZDNet article]<u></u><u></u></b></p>
<p class="MsoNormal" style="background:white;vertical-align:baseline"><u></u> <u></u></p>
<p class="MsoNormal" style="background:white;vertical-align:baseline">***When will Google implement this change? I would argue that this is unclear, but <span style="border:none windowtext 1.0pt;padding:0in">the CASC [CA Security Council] is claiming</span> that
the schedule is for Chrome 39. The current stable version is Chrome 37. I'm told by a Symantec employee that <span style="border:none windowtext 1.0pt;padding:0in">Google gave Chrome 39 as a target</span> in a recent conference call of members of the CA/Browser
Forum. And <span style="border:none windowtext 1.0pt;padding:0in">in a mailing list discussion on August 12</span>, Ryan Sleevi, a Senior Software Engineer at Google who works on the cryptography in the Chromium platform, certainly seems to say that he's planning
to implement the change in Chrome 39.<u></u><u></u></p>
<p class="MsoNormal" style="background:white;vertical-align:baseline"><u></u> <u></u></p>
<p class="MsoNormal" style="background:white;vertical-align:baseline">In fact, the first dev and canary builds of Chrome 39 came out over the weekend and they do not implement the proposed behavior. Sleevi <span style="border:none windowtext 1.0pt;padding:0in">says
that it is not implemented</span> and that "... it is still under active review and discussion." There is a defined process for <span style="border:none windowtext 1.0pt;padding:0in">feature deprecation in Chromium</span>. It looks long and complicated and
getting it done by Chrome 39 looks tough to me.<u></u><u></u></p>
<p class="MsoNormal" style="background:white;vertical-align:baseline"><u></u> <u></u></p>
<p class="MsoNormal" style="background:white;vertical-align:baseline">The CASC says, based on the assumption of an implementation in Chrome 39, that Google is being too aggressive. The schedule for Chrome 39 would see it released to the stable channel in or
about late November, at the height of the holiday shopping season. If consumers start seeing what looks like an HTTPS error, which they have been told to take as a warning of potentially fraudulent activity, the result could be lost sales for commerce sites.
***<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
</div>
<table><tbody><tr><td bgcolor="#ffffff"><font color="#000000"><pre><table><tbody><tr><td><pre>TREND MICRO EMAIL NOTICE
The information contained in this email and any attachments is confidential
and may be subject to copyright or other intellectual property protection.
If you are not the intended recipient, you are not authorized to use or
disclose this information, and we request that you notify us by reply mail or
telephone and delete the original message from your mail system.
</pre></td></tr></tbody></table></pre></font></td></tr></tbody></table>
</blockquote></div><br></div>