<html>
<head>
<meta name="generator" content="Windows Mail 17.5.9600.20573">
<style><!--
p.MsoNormal, li.MsoNormal, div.MsoNormal {
margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman","serif";
}
--></style><style data-externalstyle="true"><!--
p.MsoListParagraph, li.MsoListParagraph, div.MsoListParagraph {
margin-top:0in;
margin-right:0in;
margin-bottom:0in;
margin-left:.5in;
margin-bottom:.0001pt;
}
p.MsoNormal, li.MsoNormal, div.MsoNormal {
margin:0in;
margin-bottom:.0001pt;
}
p.MsoListParagraphCxSpFirst, li.MsoListParagraphCxSpFirst, div.MsoListParagraphCxSpFirst,
p.MsoListParagraphCxSpMiddle, li.MsoListParagraphCxSpMiddle, div.MsoListParagraphCxSpMiddle,
p.MsoListParagraphCxSpLast, li.MsoListParagraphCxSpLast, div.MsoListParagraphCxSpLast {
margin-top:0in;
margin-right:0in;
margin-bottom:0in;
margin-left:.5in;
margin-bottom:.0001pt;
line-height:115%;
}
--></style></head>
<body dir="ltr">
<div data-externalstyle="false" dir="ltr" style="font-family: 'Calibri', 'Segoe UI', 'Meiryo', 'Microsoft YaHei UI', 'Microsoft JhengHei UI', 'Malgun Gothic', 'sans-serif';font-size:12pt;"><div>hello</div><div><br></div><div><u><font color="#ff0000">“Subscriber Certificates utilizing the SHA-1 algorithm “</font></u></div><div><u><font color="#ff0000"></font></u><br></div><div><br></div><div data-signatureblock="true"><div>You should not write this because SHA-1 algo is still used in order to compute AKI and SKI.</div><div>So you should refine to SHA-1withRSAencryption for signature algorithm.</div><div><br></div><div>My 2 cents….</div><div><br></div><div>Franck.<br></div><div><br></div><div><br></div><div>Envoyé depuis Windows Mail</div><div><br></div></div><div style="padding-top: 5px; border-top-color: rgb(229, 229, 229); border-top-width: 1px; border-top-style: solid;"><div><font face=" 'Calibri', 'Segoe UI', 'Meiryo', 'Microsoft YaHei UI', 'Microsoft JhengHei UI', 'Malgun Gothic', 'sans-serif'" style='line-height: 15pt; letter-spacing: 0.02em; font-family: "Calibri", "Segoe UI", "Meiryo", "Microsoft YaHei UI", "Microsoft JhengHei UI", "Malgun Gothic", "sans-serif"; font-size: 12pt;'><b>De :</b> <a href="mailto:kirk_hall@trendmicro.com" target="_parent">kirk_hall@trendmicro.com</a><br><b>Envoyé :</b> samedi 6 septembre 2014 01:11<br><b>À :</b> <a href="mailto:sleevi@google.com" target="_parent">Ryan Sleevi</a>, <a href="mailto:tomalb@microsoft.com" target="_parent">Tom Albertson</a><br><b>Cc :</b> <a href="mailto:public@cabforum.org" target="_parent">public@cabforum.org</a></font></div></div><div><br></div><div dir="">
<div class="WordSection1">
<p class="MsoNormal"><span style='color: rgb(31, 73, 125); font-family: "Calibri","sans-serif";'>Trend Micro will endorse this ballot as well – good idea.</span><span style='color: rgb(31, 73, 125); font-family: "Calibri","sans-serif"; font-size: 11pt;'></span></p>
<p class="MsoNormal"><span style='color: rgb(31, 73, 125); font-family: "Calibri","sans-serif"; font-size: 11pt;'> </span></p>
<p class="MsoNormal"><b><span style='font-family: "Tahoma","sans-serif"; font-size: 10pt;'>From:</span></b><span style='font-family: "Tahoma","sans-serif"; font-size: 10pt;'> public-bounces@cabforum.org [mailto:public-bounces@cabforum.org]
<b>On Behalf Of </b>Ryan Sleevi<br>
<b>Sent:</b> Friday, September 05, 2014 4:08 PM<br>
<b>To:</b> Tom Albertson<br>
<b>Cc:</b> CABFPub<br>
<b>Subject:</b> Re: [cabfpub] FW: Ballot - expiration of SHA1 certificates</span></p>
<p class="MsoNormal"> </p>
<p>Hi Tom,</p>
<p>We would be happy to endorse.</p>
<div>
<p class="MsoNormal">On Sep 5, 2014 3:47 PM, "Tom Albertson" <<a href="mailto:tomalb@microsoft.com" target="_parent">tomalb@microsoft.com</a>> wrote:</p>
<div>
<div>
<p class="MsoNormal">Hi there,</p>
<p class="MsoNormal"> </p>
<p class="MsoNormal">I have produced a ballot for discussion, which aligns the Baseline Requirements (v1.1.9) with the planned deprecation of SHA-1. This ballot uses the dates in the
<a href="http://blogs.technet.com/b/pki/archive/2013/11/12/sha1-deprecation-policy.aspx" target="_parent">
Microsoft SHA-1 deprecation policy</a> as a reference, and right now only addresses SSL certs. I think we can offer similar language for code signing certs and possibly other BRs once we have hashed this out for SSL.</p>
<p class="MsoNormal"> </p>
<p class="MsoNormal">New text appears as <u><span style="color: red;">red underlined</span></u>. A small amount of text in Appendix A is proposed for deletion (<s>black strikethrough)</s> The amendments relate mainly to Section 9.4 Validity Period,
with minor conforming changes to Appendix A.</p>
<p class="MsoNormal"> </p>
<p class="MsoNormal">Special thanks to Ben and Gerv and others, who already struggled through this issue in March 2014, that ballot discussion was most instructive. I have made no efforts to collaborate with other Forum members on this issue except
to go back and forth with Kelvin and Aaron here at Microsoft on the best text to offer to represent the Microsoft policy.
</p>
<p class="MsoNormal"> </p>
<p class="MsoNormal">Your comments and questions are appreciated, and ultimately we could use an endorser or two of the ballot measure.
</p>
<p class="MsoNormal"> </p>
<p class="MsoNormal">Thanks,</p>
<p class="MsoNormal">Tom</p>
<p class="MsoNormal"> </p>
<p class="MsoNormal"><b><span style="color: rgb(31, 73, 125);">Ballot NNN –expirations of SHA1 certificates (FINAL VERSION)</span></b></p>
<p class="MsoNormal"><span style="color: rgb(31, 73, 125);"> </span></p>
<p class="MsoNormal"> </p>
<p class="MsoNormal"><b><i><span style="font-family: Cambria-BoldItalic; font-size: 14pt;">9.4 Validity Period</span></i></b></p>
<p class="MsoNormal"><b><span style="font-family: Cambria-Bold; font-size: 13pt;"> </span></b></p>
<p class="MsoNormal"><b><span style="font-family: Cambria-Bold; font-size: 13pt;">9.4.1 Subscriber Certificates</span></b></p>
<p class="MsoNormal">Subscriber Certificates issued after the Effective Date MUST have a Validity Period no greater than 60 months.</p>
<p class="MsoNormal"> </p>
<p class="MsoNormal">Except as provided for below, Subscriber Certificates issued after 1 April 2015 MUST have a Validity Period no</p>
<p class="MsoNormal">greater than 39 months.</p>
<p class="MsoNormal">
</p>
<p class="MsoNormal"><u><span style="color: red;">Effective 1 November 2014, CAs MUST NOT issue Subscriber Certificates utilizing the SHA-1 algorithm with an Expiry Date greater than 1 January 2017.</span><span style="color: rgb(0, 176, 80);">
</span></u></p>
<p class="MsoNormal"><span style="color: red;"> </span></p>
<p class="MsoNormal"><u><span style="color: red;">Except as provided for below, effective 1 January 2016, CAs MUST NOT issue Subscriber Certificates that utilize the SHA-1 algorithm.</span><span style="color: rgb(0, 176, 80);">
</span></u></p>
<p class="MsoNormal"><u>
</u></p>
<p class="MsoNormal"><u><span style="color: red;">Effective</span></u><span style="color: red;">
</span>1 April 2015, CAs MAY continue to issue Subscriber Certificates with a Validity Period greater than 39</p>
<p class="MsoNormal">months but not greater than 60 months provided that the CA documents that the Certificate is for a system or</p>
<p class="MsoNormal">software that:</p>
<p class="MsoNormal">(a) was in use prior to the Effective Date;</p>
<p class="MsoNormal">(b) is currently in use by either the Applicant or a substantial number of Relying Parties;</p>
<p class="MsoNormal">(c) fails to operate if the Validity Period is shorter than 60 months;</p>
<p class="MsoNormal">(d) does not contain known security risks to Relying Parties; and</p>
<p class="MsoNormal">(e) is difficult to patch or replace without substantial economic outlay.</p>
<p class="MsoNormal"> </p>
<p class="MsoNormal"> </p>
<p class="MsoNormal"><b><u><span style="color: red;">9.4.2 Root CA Certificates</span></u></b></p>
<p class="MsoNormal"><span style="color: red;"> </span></p>
<p class="MsoNormal"><u><span style="color: red;">The SHA-1 deprecation policy and Validity Dates DO NOT apply to Root CA certificates. CAs MAY continue to use their existing SHA-1 Root Certificates.
</span></u><u><span lang="EN" style="color: red;">CAs MUST use SHA-2 or successor hash algorithms to sign any Subscriber certificates, Subordinate CA certificates, and CRLs effective 1 January 2016.</span></u></p>
<p class="MsoNormal"><span style="color: red;"> </span></p>
<p class="MsoNormal"><span style="color: red;"> </span></p>
<p class="MsoNormal"><b><u><span style="color: red;">9.4.3 Subordinate CA Certificates</span></u></b></p>
<p class="MsoNormal"><span style="color: red;"> </span></p>
<p class="MsoNormal"><u><span style="color: red;">Effective 1 January 2016, CAs MUST NOT issue Subordinate CA Certificates that utilize the SHA-1 algorithm. CAs MUST NOT issue SHA-2 Subscriber certificates under SHA-1 Subordinate CA Certificates.</span></u><span style="color: red;">
</span></p>
<p class="MsoNormal"> </p>
<p class="MsoNormal"> </p>
<p class="MsoNormal"><b><span style="font-size: 14pt;">Appendix A - Cryptographic Algorithm and Key Requirements (Normative)</span></b></p>
<p class="MsoNormal">…</p>
<p class="MsoNormal"><span style="color: rgb(31, 73, 125);"> </span></p>
<p class="MsoNormal"><span style="color: rgb(31, 73, 125);">Add this note under Table 2, Subordinate CA certificates:</span></p>
<p class="MsoNormal"><span style="color: rgb(31, 73, 125);"> </span></p>
<p class="MsoNormal"><u><span style="color: red;">* SHA-1 MAY be used with RSA keys in accordance with the criteria defined in Section 9.4.3.</span></u></p>
<p class="MsoNormal"><span style="color: red;"> </span></p>
<p class="MsoNormal">And amend this note at the end of the 3 tables. </p>
<p class="MsoNormal"><span style="color: red;"> </span></p>
<p class="MsoNormal">* SHA-1 MAY be used with RSA keys<span style="color: rgb(31, 73, 125);">
</span><u><span style="color: red;">in accordance with the criteria defined in Section 9.4.1
</span></u><s><span style="font-family: TimesNewRomanPSMT; font-size: 10pt;">until SHA-256 is supported widely by browsers used by a substantial</span></s></p>
<p class="MsoNormal"><s><span style="font-family: TimesNewRomanPSMT; font-size: 10pt;">portion of relying-parties worldwide</span></s><span style="font-family: TimesNewRomanPSMT; font-size: 10pt;">.
</span></p>
<p class="MsoNormal"> </p>
</div>
</div>
<p class="MsoNormal" style="margin-bottom: 12pt;"><br>
_______________________________________________<br>
Public mailing list<br>
<a href="mailto:Public@cabforum.org" target="_parent">Public@cabforum.org</a><br>
<a href="https://cabforum.org/mailman/listinfo/public" target="_parent">https://cabforum.org/mailman/listinfo/public</a></p>
</div>
</div>
<table tabindex="-1">
<tbody>
<tr>
<td bgcolor="#ffffff"><font color="#000000">
<pre><table tabindex="-1" class="TM_EMAIL_NOTICE"><tbody><tr><td><pre>TREND MICRO EMAIL NOTICE
The information contained in this email and any attachments is confidential
and may be subject to copyright or other intellectual property protection.
If you are not the intended recipient, you are not authorized to use or
disclose this information, and we request that you notify us by reply mail or
telephone and delete the original message from your mail system.
</pre></td></tr></tbody></table></pre>
</font></td>
</tr>
</tbody>
</table>
</div><div><br></div></div>
</body>
</html>