<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman","serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p
{mso-style-priority:99;
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:12.0pt;
font-family:"Times New Roman","serif";}
span.EmailStyle18
{mso-style-type:personal-reply;
font-family:"Calibri","sans-serif";
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri","sans-serif";}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">Yes unfortunately, it is too common.
<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><b><span style="font-size:11.0pt;font-family:"Calibri","sans-serif"">From:</span></b><span style="font-size:11.0pt;font-family:"Calibri","sans-serif""> Ryan Sleevi [mailto:sleevi@google.com]
<br>
<b>Sent:</b> Tuesday, October 7, 2014 11:35 AM<br>
<b>To:</b> Kelvin Yiu<br>
<b>Cc:</b> CABFPub; Gervase Markham<br>
<b>Subject:</b> RE: [cabfpub] Ballot 118 - SHA1 Sunset<o:p></o:p></span></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p><br>
On Oct 7, 2014 2:27 PM, "Kelvin Yiu" <<a href="mailto:kelviny@exchange.microsoft.com">kelviny@exchange.microsoft.com</a>> wrote:<br>
><br>
> I think you have 2 problems when trying to support XP users after 1/1/2016:<br>
><br>
> 1. Not being able to get new SHA1 SSL certificates that works on XP<br>
> 2. Not being able to get new code signing certificates to sign new builds of Firefox, or sign Firefox in such a way that the same file will work on XP and the latest Windows release.<br>
><br>
> Assuming you can workaround the first problem by finding a 1024 bit root CA that may or may not meet other security requirements, how will you deal with the 2nd problem?<br>
><br>
> Kelvin<br>
><o:p></o:p></p>
<p>Sign a "download loader" binary that does the fetching of a non-Authenticode data blob?<o:p></o:p></p>
<p>(Terribly common, for better or worse)<o:p></o:p></p>
<p>> -----Original Message-----<br>
> From: <a href="mailto:public-bounces@cabforum.org">public-bounces@cabforum.org</a> [mailto:<a href="mailto:public-bounces@cabforum.org">public-bounces@cabforum.org</a>] On Behalf Of Gervase Markham<br>
> Sent: Friday, October 3, 2014 3:24 AM<br>
> To: Ryan Sleevi<br>
> Cc: CABFPub<br>
> Subject: Re: [cabfpub] Ballot 118 - SHA1 Sunset<br>
><br>
> On 03/10/14 10:17, Ryan Sleevi wrote:<br>
> > It is worth noting that, according to Microsoft's policies (which, I<br>
> > should note, Chrome has also adopted), no SHA-1 certs can be issued by<br>
> > members of the root programs.<br>
><br>
> By CAs who are members of their root programs? Or by roots which are trusted by their root programs?<br>
><br>
> It might be possible to find a root, such as a 1024-bit one, which has been removed from root programs but is still trusted by the older browsers which such a scheme would target. Is there anything in Microsoft's or Google's policies which would prevent us
asking a CA with such a root to issue us a SHA-1 certificate for the purpose of getting people onto software which supports SHA-256?<br>
><br>
> > However, I think you perhaps have too rosy a view about how such an<br>
> > exemption would play out in practice. If browsers adopt negative UI<br>
> > (as Chrome does, and as have both you and other Mozilla developers<br>
> > suggested Firefox will/should) for such post-2016 certs, then the<br>
> > ability to reasonably enforce such UI is contingent upon believing no<br>
> > CAs will be issuing such certs.<br>
><br>
> Not really. Given that you are putting the UI in now, a row-back later would not have much immediate effect on the number of people who would get negative UI. Which would make a change of mind, even if you wanted one, impossible.<br>
><br>
> > The situation you describe - which doesn't arise until Jan 2016 -<br>
><br>
> Yes, indeed. But the de-adoption curves are not looking all that awesome.<br>
><br>
> > appetite for that. I think it's reasonable that by 2016, if you're<br>
> > still running a 15 year old OS, you'll have a bad time. And not just<br>
> > because SHA-1, but because SNI, ECDSA, etc.<br>
><br>
> Right. If we could get people to upgrade, we would.<br>
><br>
> Gerv<br>
> _______________________________________________<br>
> Public mailing list<br>
> <a href="mailto:Public@cabforum.org">Public@cabforum.org</a><br>
> <a href="https://cabforum.org/mailman/listinfo/public">https://cabforum.org/mailman/listinfo/public</a><o:p></o:p></p>
</div>
</body>
</html>