<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=Windows-1252">
<style type="text/css" style="display:none;"><!-- P {margin-top:0;margin-bottom:0;} --></style>
</head>
<body dir="ltr">
<div style="color: rgb(0, 0, 0); font-family: Calibri,Arial,Helvetica,sans-serif,'Apple Color Emoji', 'Segoe UI Emoji', NotoColorEmoji, 'Segoe UI Symbol', 'Android Emoji', EmojiSymbols; font-size: 12pt; background-color: rgb(255, 255, 255);" dir="ltr" useinlinestyle="true">
<p>I wont be able to join since I am at //Build conference. I will share my updates via email.<br>
</p>
<br>
<br>
<div style="color: rgb(0, 0, 0);">
<hr tabindex="-1" style="width: 98%; display: inline-block;">
<div id="divRplyFwdMsg" dir="ltr"><font color="#000000" face="Calibri, sans-serif" style="font-size: 11pt;"><b>From:</b> Dean Coclin <Dean_Coclin@symantec.com><br>
<b>Sent:</b> Wednesday, April 29, 2015 8:42 AM<br>
<b>To:</b> Anoosh Saboori; Bruce Morton; Rick Andrews; Erwann Abalea; public@cabforum.org<br>
<b>Subject:</b> RE: [cabfpub] Updates to Microsoft SHA-1 deprecation</font>
<div> </div>
</div>
<div>
<div>
<p style="margin: 0in 0in 0pt; font-family: "Times New Roman","serif"; font-size: 12pt;">
<span style="color: rgb(31, 73, 125); font-family: "Calibri","sans-serif"; font-size: 11pt;">Should we add this to the agenda for this week’s call?</span></p>
<p style="margin: 0in 0in 0pt; font-family: "Times New Roman","serif"; font-size: 12pt;">
<span style="color: rgb(31, 73, 125); font-family: "Calibri","sans-serif"; font-size: 11pt;"><br>
Dean</span></p>
<p style="margin: 0in 0in 0pt; font-family: "Times New Roman","serif"; font-size: 12pt;">
<span style="color: rgb(31, 73, 125); font-family: "Calibri","sans-serif"; font-size: 11pt;"> </span></p>
<div>
<div style="border-width: 1pt medium medium; border-style: solid none none; border-color: rgb(181, 196, 223) currentColor currentColor; padding: 3pt 0in 0in; border-image: none;">
<p style="margin: 0in 0in 0pt; font-family: "Times New Roman","serif"; font-size: 12pt;">
<b><span style="font-family: "Tahoma","sans-serif"; font-size: 10pt;">From:</span></b><span style="font-family: "Tahoma","sans-serif"; font-size: 10pt;"> public-bounces@cabforum.org [mailto:public-bounces@cabforum.org]
<b>On Behalf Of </b>Anoosh Saboori<br>
<b>Sent:</b> Monday, April 27, 2015 1:04 PM<br>
<b>To:</b> Bruce Morton; Rick Andrews; Erwann Abalea; public@cabforum.org<br>
<b>Subject:</b> Re: [cabfpub] Updates to Microsoft SHA-1 deprecation</span></p>
</div>
</div>
<p style="margin: 0in 0in 0pt; font-family: "Times New Roman","serif"; font-size: 12pt;">
</p>
<div>
<p style="background: white;"><span style="color: black; font-family: "Calibri","sans-serif";">My apologies for late response. I was out of office for an extended period of time. I should be able to finalize below email this week and get back to the thread.
Thanks for your patience.</span></p>
<p style="background: white;"><span style="color: black; font-family: "Calibri","sans-serif";"> </span></p>
<p style="background: white;"><span style="color: black; font-family: "Calibri","sans-serif";">Anoosh</span></p>
<p style="background: white;"><span style="color: black; font-family: "Calibri","sans-serif";"> </span></p>
<p style="background: white; margin: 0in 0in 0pt; font-family: "Times New Roman","serif"; font-size: 12pt;">
<span style="color: black; font-family: "Calibri","sans-serif";"> </span></p>
<div>
<div align="center" style="background: white; margin: 0in 0in 0pt; text-align: center; font-family: "Times New Roman","serif"; font-size: 12pt;">
<span style="color: black; font-family: "Calibri","sans-serif";">
<hr width="98%" size="2" align="center">
</span></div>
<div id="divRplyFwdMsg">
<p style="background: white; margin: 0in 0in 0pt; font-family: "Times New Roman","serif"; font-size: 12pt;">
<b><span style="color: black; font-family: "Calibri","sans-serif"; font-size: 11pt;">From:</span></b><span style="color: black; font-family: "Calibri","sans-serif"; font-size: 11pt;"> Bruce Morton <<a style="color: blue; text-decoration: underline;" href="mailto:bruce.morton@entrust.com">bruce.morton@entrust.com</a>><br>
<b>Sent:</b> Monday, April 27, 2015 12:13 PM<br>
<b>To:</b> Anoosh Saboori; Rick Andrews; Erwann Abalea; <a style="color: blue; text-decoration: underline;" href="mailto:public@cabforum.org">
public@cabforum.org</a><br>
<b>Subject:</b> RE: [cabfpub] Updates to Microsoft SHA-1 deprecation</span><span style="color: black; font-family: "Calibri","sans-serif";">
</span></p>
<div>
<p style="background: white; margin: 0in 0in 0pt; font-family: "Times New Roman","serif"; font-size: 12pt;">
<span style="color: black; font-family: "Calibri","sans-serif";"> </span></p>
</div>
</div>
<div>
<div>
<p style="background: white; margin: 0in 0in 0pt; font-family: "Times New Roman","serif"; font-size: 12pt;">
<span style="color: rgb(31, 73, 125); font-family: "Calibri","sans-serif"; font-size: 11pt;">Hi Anoosh,</span><span style="color: black;"></span></p>
<p style="background: white; margin: 0in 0in 0pt; font-family: "Times New Roman","serif"; font-size: 12pt;">
<span style="color: rgb(31, 73, 125); font-family: "Calibri","sans-serif"; font-size: 11pt;"> </span><span style="color: black;"></span></p>
<p style="background: white; margin: 0in 0in 0pt; font-family: "Times New Roman","serif"; font-size: 12pt;">
<span style="color: rgb(31, 73, 125); font-family: "Calibri","sans-serif"; font-size: 11pt;">Is there any update to this request?</span><span style="color: black;"></span></p>
<p style="background: white; margin: 0in 0in 0pt; font-family: "Times New Roman","serif"; font-size: 12pt;">
<span style="color: rgb(31, 73, 125); font-family: "Calibri","sans-serif"; font-size: 11pt;"> </span><span style="color: black;"></span></p>
<p style="background: white; margin: 0in 0in 0pt; font-family: "Times New Roman","serif"; font-size: 12pt;">
<span style="color: rgb(31, 73, 125); font-family: "Calibri","sans-serif"; font-size: 11pt;">Thanks, Bruce.</span><span style="color: black;"></span></p>
<p style="background: white; margin: 0in 0in 0pt; font-family: "Times New Roman","serif"; font-size: 12pt;">
<span style="color: rgb(31, 73, 125); font-family: "Calibri","sans-serif"; font-size: 11pt;"> </span><span style="color: black;"></span></p>
<div>
<div style="border-width: 1pt medium medium; border-style: solid none none; border-color: rgb(225, 225, 225) currentColor currentColor; padding: 3pt 0in 0in; border-image: none;">
<p style="background: white; margin: 0in 0in 0pt; font-family: "Times New Roman","serif"; font-size: 12pt;">
<b><span style="font-family: "Calibri","sans-serif"; font-size: 11pt;">From:</span></b><span style="font-family: "Calibri","sans-serif"; font-size: 11pt;">
<a style="color: blue; text-decoration: underline;" href="mailto:public-bounces@cabforum.org">
public-bounces@cabforum.org</a> [<a style="color: blue; text-decoration: underline;" href="mailto:public-bounces@cabforum.org">mailto:public-bounces@cabforum.org</a>]
<b>On Behalf Of </b>Anoosh Saboori<br>
<b>Sent:</b> Monday, March 23, 2015 3:35 PM<br>
<b>To:</b> Rick Andrews; Erwann Abalea; <a style="color: blue; text-decoration: underline;" href="mailto:public@cabforum.org">
public@cabforum.org</a><br>
<b>Subject:</b> Re: [cabfpub] Updates to Microsoft SHA-1 deprecation</span><span style="color: black;"></span></p>
</div>
</div>
<p style="background: white; margin: 0in 0in 0pt; font-family: "Times New Roman","serif"; font-size: 12pt;">
<span style="color: black;"> </span></p>
<p style="background: white; margin: 0in 0in 0pt; font-family: "Times New Roman","serif"; font-size: 12pt;">
<span style="color: rgb(31, 73, 125); font-family: "Calibri","sans-serif"; font-size: 11pt;">I am consolidating the feedbacks and get back to you shortly.
</span><span style="color: black;"></span></p>
<p style="background: white; margin: 0in 0in 0pt; font-family: "Times New Roman","serif"; font-size: 12pt;">
<span style="color: rgb(31, 73, 125); font-family: "Calibri","sans-serif"; font-size: 11pt;"> </span><span style="color: black;"></span></p>
<div>
<div style="border-width: 1pt medium medium; border-style: solid none none; border-color: rgb(225, 225, 225) currentColor currentColor; padding: 3pt 0in 0in; border-image: none;">
<p style="background: white; margin: 0in 0in 0pt; font-family: "Times New Roman","serif"; font-size: 12pt;">
<b><span style="font-family: "Calibri","sans-serif"; font-size: 11pt;">From:</span></b><span style="font-family: "Calibri","sans-serif"; font-size: 11pt;">
<a style="color: blue; text-decoration: underline;" href="mailto:public-bounces@cabforum.org">
public-bounces@cabforum.org</a> [<a style="color: blue; text-decoration: underline;" href="mailto:public-bounces@cabforum.org">mailto:public-bounces@cabforum.org</a>]
<b>On Behalf Of </b>Rick Andrews<br>
<b>Sent:</b> Monday, March 23, 2015 10:52 AM<br>
<b>To:</b> Erwann Abalea; <a style="color: blue; text-decoration: underline;" href="mailto:public@cabforum.org">
public@cabforum.org</a><br>
<b>Subject:</b> Re: [cabfpub] Updates to Microsoft SHA-1 deprecation</span><span style="color: black;"></span></p>
</div>
</div>
<p style="background: white; margin: 0in 0in 0pt; font-family: "Times New Roman","serif"; font-size: 12pt;">
<span style="color: black;"> </span></p>
<p style="background: white; margin: 0in 0in 0pt; font-family: "Times New Roman","serif"; font-size: 12pt;">
<span style="color: rgb(31, 73, 125); font-family: "Calibri","sans-serif"; font-size: 11pt;">Thanks, Erwann. I missed that.</span><span style="color: black;"></span></p>
<p style="background: white; margin: 0in 0in 0pt; font-family: "Times New Roman","serif"; font-size: 12pt;">
<span style="color: rgb(31, 73, 125); font-family: "Calibri","sans-serif"; font-size: 11pt;"> </span><span style="color: black;"></span></p>
<p style="background: white; margin: 0in 0in 0pt; font-family: "Times New Roman","serif"; font-size: 12pt;">
<span style="color: rgb(31, 73, 125); font-family: "Calibri","sans-serif"; font-size: 11pt;">Two questions for Anoosh:</span><span style="color: black;"></span></p>
<p style="background: white; margin: 0in 0in 0pt; text-indent: -0.25in; font-family: "Times New Roman","serif"; font-size: 12pt;">
<span style="color: black;">1)</span><span style="color: black; font-size: 7pt;">
</span><span style="color: rgb(31, 73, 125); font-family: "Calibri","sans-serif"; font-size: 11pt;">What’s the rationale for 1/1/2016? I’m almost certain that Tom said it wouldn’t be required until 1/1/2017.</span><span style="color: black;"></span></p>
<p style="background: white; margin: 0in 0in 0pt; text-indent: -0.25in; font-family: "Times New Roman","serif"; font-size: 12pt;">
<span style="color: black;">2)</span><span style="color: black; font-size: 7pt;">
</span><span style="color: rgb(31, 73, 125); font-family: "Calibri","sans-serif"; font-size: 11pt;">Echoing Bruce’s comment, is there any way that you can pull all the details together in a more understandable format? IMO, I shouldn’t have to read through all
5 pages of comments to see what the policy is. It’s great that Microsoft accepts comments (and answers them!) but if someone posts a question it probably means that the policy statement is lacking, and should be updated.</span><span style="color: black;"></span></p>
<p style="background: white; margin: 0in 0in 0pt; font-family: "Times New Roman","serif"; font-size: 12pt;">
<span style="color: rgb(31, 73, 125); font-family: "Calibri","sans-serif"; font-size: 11pt;"> </span><span style="color: black;"></span></p>
<p style="background: white; margin: 0in 0in 0pt; font-family: "Times New Roman","serif"; font-size: 12pt;">
<span style="color: rgb(31, 73, 125); font-family: "Calibri","sans-serif"; font-size: 11pt;">-Rick</span><span style="color: black;"></span></p>
<p style="background: white; margin: 0in 0in 0pt; font-family: "Times New Roman","serif"; font-size: 12pt;">
<span style="color: rgb(31, 73, 125); font-family: "Calibri","sans-serif"; font-size: 11pt;"> </span><span style="color: black;"></span></p>
<div>
<div style="border-width: 1pt medium medium; border-style: solid none none; border-color: rgb(181, 196, 223) currentColor currentColor; padding: 3pt 0in 0in; border-image: none;">
<p style="background: white; margin: 0in 0in 0pt; font-family: "Times New Roman","serif"; font-size: 12pt;">
<b><span style="font-family: "Tahoma","sans-serif"; font-size: 10pt;">From:</span></b><span style="font-family: "Tahoma","sans-serif"; font-size: 10pt;">
<a style="color: blue; text-decoration: underline;" href="mailto:public-bounces@cabforum.org">
public-bounces@cabforum.org</a> [<a style="color: blue; text-decoration: underline;" href="mailto:public-bounces@cabforum.org">mailto:public-bounces@cabforum.org</a>]
<b>On Behalf Of </b>Erwann Abalea<br>
<b>Sent:</b> Monday, March 23, 2015 9:05 AM<br>
<b>To:</b> <a style="color: blue; text-decoration: underline;" href="mailto:public@cabforum.org">
public@cabforum.org</a><br>
<b>Subject:</b> Re: [cabfpub] Updates to Microsoft SHA-1 deprecation</span><span style="color: black;"></span></p>
</div>
</div>
<p style="background: white; margin: 0in 0in 0pt; font-family: "Times New Roman","serif"; font-size: 12pt;">
<span style="color: black;"> </span></p>
<p style="background: white; margin: 0in 0in 0pt; font-family: "Times New Roman","serif"; font-size: 12pt;">
<span style="color: black;"><a style="color: blue; text-decoration: underline;" href="http://blogs.technet.com/b/pki/archive/2013/11/12/sha1-deprecation-policy.aspx#pi47623=2">http://blogs.technet.com/b/pki/archive/2013/11/12/sha1-deprecation-policy.aspx#pi47623=2</a><br>
<br>
CRLs will be SHA2-signed by 01/01/2016. See responses by "Amerk [MSFT]".<br>
<br>
</span></p>
<pre style="background: white; margin: 0in 0in 0pt; font-family: "Courier New"; font-size: 10pt;"><span style="color: black;">-- </span></pre>
<pre style="background: white; margin: 0in 0in 0pt; font-family: "Courier New"; font-size: 10pt;"><span style="color: black;">Erwann ABALEA</span></pre>
<pre style="background: white; margin: 0in 0in 0pt; font-family: "Courier New"; font-size: 10pt;"><span style="color: black;"> </span></pre>
<div>
<p style="background: white; margin: 0in 0in 0pt; font-family: "Times New Roman","serif"; font-size: 12pt;">
<span style="color: black;">Le 23/03/2015 16:57, Rick Andrews a écrit :</span></p>
</div>
<blockquote style="margin-top: 5pt; margin-bottom: 5pt;">
<p style="background: white; margin: 0in 0in 0pt; font-family: "Times New Roman","serif"; font-size: 12pt;">
<span style="color: rgb(31, 73, 125); font-family: "Calibri","sans-serif"; font-size: 11pt;">Bruce,</span><span style="color: black;"></span></p>
<p style="background: white; margin: 0in 0in 0pt; font-family: "Times New Roman","serif"; font-size: 12pt;">
<span style="color: rgb(31, 73, 125); font-family: "Calibri","sans-serif"; font-size: 11pt;"> </span><span style="color: black;"></span></p>
<p style="background: white; margin: 0in 0in 0pt; font-family: "Times New Roman","serif"; font-size: 12pt;">
<span style="color: rgb(31, 73, 125); font-family: "Calibri","sans-serif"; font-size: 11pt;">At the Beijing meeting, Tom Albertson said that by 1/1/2017, even CRLs for SHA-1 roots had to be signed with SHA-2.
</span><span style="color: black;"></span></p>
<p style="background: white; margin: 0in 0in 0pt; font-family: "Times New Roman","serif"; font-size: 12pt;">
<span style="color: rgb(31, 73, 125); font-family: "Calibri","sans-serif"; font-size: 11pt;"> </span><span style="color: black;"></span></p>
<p style="background: white; margin: 0in 0in 0pt; font-family: "Times New Roman","serif"; font-size: 12pt;">
<span style="color: rgb(31, 73, 125); font-family: "Calibri","sans-serif"; font-size: 11pt;">Anoosh, I assume that’s still Microsoft’s policy.</span><span style="color: black;"></span></p>
<p style="background: white; margin: 0in 0in 0pt; font-family: "Times New Roman","serif"; font-size: 12pt;">
<span style="color: rgb(31, 73, 125); font-family: "Calibri","sans-serif"; font-size: 11pt;"> </span><span style="color: black;"></span></p>
<p style="background: white; margin: 0in 0in 0pt; font-family: "Times New Roman","serif"; font-size: 12pt;">
<span style="color: rgb(31, 73, 125); font-family: "Calibri","sans-serif"; font-size: 11pt;">-Rick</span><span style="color: black;"></span></p>
<p style="background: white; margin: 0in 0in 0pt; font-family: "Times New Roman","serif"; font-size: 12pt;">
<span style="color: rgb(31, 73, 125); font-family: "Calibri","sans-serif"; font-size: 11pt;"> </span><span style="color: black;"></span></p>
<div>
<div style="border-width: 1pt medium medium; border-style: solid none none; border-color: rgb(181, 196, 223) currentColor currentColor; padding: 3pt 0in 0in; border-image: none;">
<p style="background: white; margin: 0in 0in 0pt; font-family: "Times New Roman","serif"; font-size: 12pt;">
<b><span style="color: black; font-family: "Tahoma","sans-serif"; font-size: 10pt;">From:</span></b><span style="color: black; font-family: "Tahoma","sans-serif"; font-size: 10pt;">
<a style="color: blue; text-decoration: underline;" href="mailto:public-bounces@cabforum.org">
public-bounces@cabforum.org</a> [<a style="color: blue; text-decoration: underline;" href="mailto:public-bounces@cabforum.org">mailto:public-bounces@cabforum.org</a>]
<b>On Behalf Of </b>Bruce Morton<br>
<b>Sent:</b> Monday, March 23, 2015 7:40 AM<br>
<b>To:</b> Anoosh Saboori<br>
<b>Cc:</b> CABFPub<br>
<b>Subject:</b> Re: [cabfpub] Updates to Microsoft SHA-1 deprecation</span><span style="color: black;"></span></p>
</div>
</div>
<p style="background: white; margin: 0in 0in 0pt; font-family: "Times New Roman","serif"; font-size: 12pt;">
<span style="color: black;"> </span></p>
<p style="background: white; margin: 0in 0in 0pt; font-family: "Times New Roman","serif"; font-size: 12pt;">
<span style="color: rgb(31, 73, 125); font-family: "Calibri","sans-serif"; font-size: 11pt;">Hi Anoosh,</span><span style="color: black;"></span></p>
<p style="background: white; margin: 0in 0in 0pt; font-family: "Times New Roman","serif"; font-size: 12pt;">
<span style="color: rgb(31, 73, 125); font-family: "Calibri","sans-serif"; font-size: 11pt;"> </span><span style="color: black;"></span></p>
<p style="background: white; margin: 0in 0in 0pt; font-family: "Times New Roman","serif"; font-size: 12pt;">
<span style="color: rgb(31, 73, 125); font-family: "Calibri","sans-serif"; font-size: 11pt;">I might be the only one, but I am a little confused regarding the Windows hashing requirements. It would be great if there was a matrix to show/confirm your requirements
per Windows version.</span><span style="color: black;"></span></p>
<p style="background: white; margin: 0in 0in 0pt; font-family: "Times New Roman","serif"; font-size: 12pt;">
<span style="color: rgb(31, 73, 125); font-family: "Calibri","sans-serif"; font-size: 11pt;"> </span><span style="color: black;"></span></p>
<p style="background: white; margin: 0in 0in 0pt; font-family: "Times New Roman","serif"; font-size: 12pt;">
<span style="color: rgb(31, 73, 125); font-family: "Calibri","sans-serif"; font-size: 11pt;">I am thinking that the following must be covered:</span><span style="color: black;"></span></p>
<p style="background: white; margin: 0in 0in 0pt; font-family: "Times New Roman","serif"; font-size: 12pt;">
<span style="color: rgb(31, 73, 125); font-family: "Calibri","sans-serif"; font-size: 11pt;"> </span><span style="color: black;"></span></p>
<p style="background: white; margin: 0in 0in 0pt; text-indent: -0.25in; font-family: "Times New Roman","serif"; font-size: 12pt;">
<span style="color: rgb(31, 73, 125); font-family: Symbol; font-size: 11pt;">·</span><span style="color: rgb(31, 73, 125); font-size: 7pt;">
</span><span style="color: rgb(31, 73, 125); font-family: "Calibri","sans-serif"; font-size: 11pt;">SSL certificates</span><span style="color: black;"></span></p>
<p style="background: white; margin: 0in 0in 0pt; text-indent: -0.25in; font-family: "Times New Roman","serif"; font-size: 12pt;">
<span style="color: rgb(31, 73, 125); font-family: Symbol; font-size: 11pt;">·</span><span style="color: rgb(31, 73, 125); font-size: 7pt;">
</span><span style="color: rgb(31, 73, 125); font-family: "Calibri","sans-serif"; font-size: 11pt;">Code Signing certificates</span><span style="color: black;"></span></p>
<p style="background: white; margin: 0in 0in 0pt; text-indent: -0.25in; font-family: "Times New Roman","serif"; font-size: 12pt;">
<span style="color: rgb(31, 73, 125); font-family: Symbol; font-size: 11pt;">·</span><span style="color: rgb(31, 73, 125); font-size: 7pt;">
</span><span style="color: rgb(31, 73, 125); font-family: "Calibri","sans-serif"; font-size: 11pt;">S/MIME certificates</span><span style="color: black;"></span></p>
<p style="background: white; margin: 0in 0in 0pt; text-indent: -0.25in; font-family: "Times New Roman","serif"; font-size: 12pt;">
<span style="color: rgb(31, 73, 125); font-family: Symbol; font-size: 11pt;">·</span><span style="color: rgb(31, 73, 125); font-size: 7pt;">
</span><span style="color: rgb(31, 73, 125); font-family: "Calibri","sans-serif"; font-size: 11pt;">Time-stamping certificates</span><span style="color: black;"></span></p>
<p style="background: white; margin: 0in 0in 0pt; text-indent: -0.25in; font-family: "Times New Roman","serif"; font-size: 12pt;">
<span style="color: rgb(31, 73, 125); font-family: Symbol; font-size: 11pt;">·</span><span style="color: rgb(31, 73, 125); font-size: 7pt;">
</span><span style="color: rgb(31, 73, 125); font-family: "Calibri","sans-serif"; font-size: 11pt;">OCSP signing certificates</span><span style="color: black;"></span></p>
<p style="background: white; margin: 0in 0in 0pt; text-indent: -0.25in; font-family: "Times New Roman","serif"; font-size: 12pt;">
<span style="color: rgb(31, 73, 125); font-family: Symbol; font-size: 11pt;">·</span><span style="color: rgb(31, 73, 125); font-size: 7pt;">
</span><span style="color: rgb(31, 73, 125); font-family: "Calibri","sans-serif"; font-size: 11pt;">Code signing signatures</span><span style="color: black;"></span></p>
<p style="background: white; margin: 0in 0in 0pt; text-indent: -0.25in; font-family: "Times New Roman","serif"; font-size: 12pt;">
<span style="color: rgb(31, 73, 125); font-family: Symbol; font-size: 11pt;">·</span><span style="color: rgb(31, 73, 125); font-size: 7pt;">
</span><span style="color: rgb(31, 73, 125); font-family: "Calibri","sans-serif"; font-size: 11pt;">Time-stamp signatures</span><span style="color: black;"></span></p>
<p style="background: white; margin: 0in 0in 0pt; text-indent: -0.25in; font-family: "Times New Roman","serif"; font-size: 12pt;">
<span style="color: rgb(31, 73, 125); font-family: Symbol; font-size: 11pt;">·</span><span style="color: rgb(31, 73, 125); font-size: 7pt;">
</span><span style="color: rgb(31, 73, 125); font-family: "Calibri","sans-serif"; font-size: 11pt;">CRL signatures</span><span style="color: black;"></span></p>
<p style="background: white; margin: 0in 0in 0pt; text-indent: -0.25in; font-family: "Times New Roman","serif"; font-size: 12pt;">
<span style="color: rgb(31, 73, 125); font-family: Symbol; font-size: 11pt;">·</span><span style="color: rgb(31, 73, 125); font-size: 7pt;">
</span><span style="color: rgb(31, 73, 125); font-family: "Calibri","sans-serif"; font-size: 11pt;">OCSP signatures</span><span style="color: black;"></span></p>
<p style="background: white; margin: 0in 0in 0pt; text-indent: -0.25in; font-family: "Times New Roman","serif"; font-size: 12pt;">
<span style="color: rgb(31, 73, 125); font-family: Symbol; font-size: 11pt;">·</span><span style="color: rgb(31, 73, 125); font-size: 7pt;">
</span><span style="color: rgb(31, 73, 125); font-family: "Calibri","sans-serif"; font-size: 11pt;">there must be more …</span><span style="color: black;"></span></p>
<p style="background: white; margin: 0in 0in 0pt; font-family: "Times New Roman","serif"; font-size: 12pt;">
<span style="color: rgb(31, 73, 125); font-family: "Calibri","sans-serif"; font-size: 11pt;"> </span><span style="color: black;"></span></p>
<p style="background: white; margin: 0in 0in 0pt; font-family: "Times New Roman","serif"; font-size: 12pt;">
<span style="color: rgb(31, 73, 125); font-family: "Calibri","sans-serif"; font-size: 11pt;">An issue that I want to understand is, since some certificates can be SHA-1, can the CRL/OCSP response be signed with a SHA-1 certificate? Can the signature be SHA-1?
We would need to understand this for both root and issuing CAs.</span><span style="color: black;"></span></p>
<p style="background: white; margin: 0in 0in 0pt; font-family: "Times New Roman","serif"; font-size: 12pt;">
<span style="color: rgb(31, 73, 125); font-family: "Calibri","sans-serif"; font-size: 11pt;"> </span><span style="color: black;"></span></p>
<p style="background: white; margin: 0in 0in 0pt; font-family: "Times New Roman","serif"; font-size: 12pt;">
<span style="color: rgb(31, 73, 125); font-family: "Calibri","sans-serif"; font-size: 11pt;">If we can nail this down, then it will be easier to draft a spec for our implementation teams.</span><span style="color: black;"></span></p>
<p style="background: white; margin: 0in 0in 0pt; font-family: "Times New Roman","serif"; font-size: 12pt;">
<span style="color: rgb(31, 73, 125); font-family: "Calibri","sans-serif"; font-size: 11pt;"> </span><span style="color: black;"></span></p>
<p style="background: white; margin: 0in 0in 0pt; font-family: "Times New Roman","serif"; font-size: 12pt;">
<span style="color: rgb(31, 73, 125); font-family: "Calibri","sans-serif"; font-size: 11pt;">Thanks, Bruce.</span><span style="color: black;"></span></p>
<p style="background: white; margin: 0in 0in 0pt; font-family: "Times New Roman","serif"; font-size: 12pt;">
<span style="color: rgb(31, 73, 125); font-family: "Calibri","sans-serif"; font-size: 11pt;"> </span><span style="color: black;"></span></p>
<div>
<div style="border-width: 1pt medium medium; border-style: solid none none; border-color: rgb(225, 225, 225) currentColor currentColor; padding: 3pt 0in 0in; border-image: none;">
<p style="background: white; margin: 0in 0in 0pt; font-family: "Times New Roman","serif"; font-size: 12pt;">
<b><span style="color: black; font-family: "Calibri","sans-serif"; font-size: 11pt;">From:</span></b><span style="color: black; font-family: "Calibri","sans-serif"; font-size: 11pt;"> Anoosh Saboori [<a style="color: blue; text-decoration: underline;" href="mailto:ansaboor@microsoft.com">mailto:ansaboor@microsoft.com</a>]
<br>
<b>Sent:</b> Saturday, March 21, 2015 8:29 PM<br>
<b>To:</b> Bruce Morton<br>
<b>Cc:</b> CABFPub<br>
<b>Subject:</b> RE: [cabfpub] Updates to Microsoft SHA-1 deprecation</span><span style="color: black;"></span></p>
</div>
</div>
<p style="background: white; margin: 0in 0in 0pt; font-family: "Times New Roman","serif"; font-size: 12pt;">
<span style="color: black;"> </span></p>
<p style="background: white; margin: 0in 0in 0pt; font-family: "Times New Roman","serif"; font-size: 12pt;">
<span style="color: rgb(31, 73, 125); font-family: "Calibri","sans-serif"; font-size: 11pt;">Windows enforcement dates (i.e., date at which SHA-1 certificates will be rejected by Windows) only apply to SSL and code signing certificates. All other types of certificates
will be rejected on Windows side when SHA-1 pre-image attacks are deemed feasible by Microsoft.</span><span style="color: black;"></span></p>
<p style="background: white; margin: 0in 0in 0pt; font-family: "Times New Roman","serif"; font-size: 12pt;">
<span style="color: rgb(31, 73, 125); font-family: "Calibri","sans-serif"; font-size: 11pt;"> </span><span style="color: black;"></span></p>
<p style="background: white; margin: 0in 0in 0pt; font-family: "Times New Roman","serif"; font-size: 12pt;">
<span style="color: rgb(31, 73, 125); font-family: "Calibri","sans-serif"; font-size: 11pt;">Anoosh</span><span style="color: black;"></span></p>
<p style="background: white; margin: 0in 0in 0pt; font-family: "Times New Roman","serif"; font-size: 12pt;">
<span style="color: rgb(31, 73, 125); font-family: "Calibri","sans-serif"; font-size: 11pt;"> </span><span style="color: black;"></span></p>
<p style="background: white; margin: 0in 0in 0pt; font-family: "Times New Roman","serif"; font-size: 12pt;">
<a name="_MailEndCompose"></a><span style="color: rgb(31, 73, 125); font-family: "Calibri","sans-serif"; font-size: 11pt;"> </span><span style="color: black;"></span></p>
<div>
<div style="border-width: 1pt medium medium; border-style: solid none none; border-color: rgb(225, 225, 225) currentColor currentColor; padding: 3pt 0in 0in; border-image: none;">
<p style="background: white; margin: 0in 0in 0pt; font-family: "Times New Roman","serif"; font-size: 12pt;">
<b><span style="color: black; font-family: "Calibri","sans-serif"; font-size: 11pt;">From:</span></b><span style="color: black; font-family: "Calibri","sans-serif"; font-size: 11pt;"> Bruce Morton [<a style="color: blue; text-decoration: underline;" href="mailto:bruce.morton@entrust.com">mailto:bruce.morton@entrust.com</a>]
<br>
<b>Sent:</b> Friday, March 20, 2015 6:47 PM<br>
<b>To:</b> Anoosh Saboori<br>
<b>Cc:</b> CABFPub<br>
<b>Subject:</b> Re: [cabfpub] Updates to Microsoft SHA-1 deprecation</span><span style="color: black;"></span></p>
</div>
</div>
<p style="background: white; margin: 0in 0in 0pt; font-family: "Times New Roman","serif"; font-size: 12pt;">
<span style="color: black;"> </span></p>
<div>
<p style="background: white; margin: 0in 0in 0pt; font-family: "Times New Roman","serif"; font-size: 12pt;">
<span style="color: black;">Hi Anoosh,</span></p>
</div>
<div>
<p style="background: white; margin: 0in 0in 0pt; font-family: "Times New Roman","serif"; font-size: 12pt;">
<span style="color: black;"> </span></p>
</div>
<div>
<p style="background: white; margin: 0in 0in 0pt; font-family: "Times New Roman","serif"; font-size: 12pt;">
<span style="color: black;">Thank you for the update.</span></p>
</div>
<div>
<p style="background: white; margin: 0in 0in 0pt; font-family: "Times New Roman","serif"; font-size: 12pt;">
<span style="color: black;"> </span></p>
</div>
<div>
<p style="background: white; margin: 0in 0in 0pt; font-family: "Times New Roman","serif"; font-size: 12pt;">
<span style="color: black;">I don't think the policy for S/MIME certificates has been stated. I see some discussion in the comments. Could you also advise how the SHA-1 deprecation policy applies to S/MIME certificates. </span></p>
</div>
<div>
<p style="background: white; margin: 0in 0in 0pt; font-family: "Times New Roman","serif"; font-size: 12pt;">
<span style="color: black;"> </span></p>
</div>
<div>
<p style="background: white; margin: 0in 0in 0pt; font-family: "Times New Roman","serif"; font-size: 12pt;">
<span style="color: black;">Thanks, Bruce.</span></p>
</div>
<div>
<p style="background: white; margin: 0in 0in 0pt; font-family: "Times New Roman","serif"; font-size: 12pt;">
<span style="color: black;"><br>
On Mar 20, 2015, at 8:57 PM, Anoosh Saboori <<a style="color: blue; text-decoration: underline;" href="mailto:ansaboor@microsoft.com">ansaboor@microsoft.com</a>> wrote:</span></p>
</div>
<blockquote style="margin-top: 5pt; margin-bottom: 5pt;">
<div>
<p style="background: white; margin: 0in 0in 0pt; font-family: "Times New Roman","serif"; font-size: 12pt;">
<span style="color: black; font-family: "Calibri","sans-serif"; font-size: 11pt;">Hello,</span><span style="color: black;"></span></p>
<p style="background: white; margin: 0in 0in 0pt; font-family: "Times New Roman","serif"; font-size: 12pt;">
<span style="color: black; font-family: "Calibri","sans-serif"; font-size: 11pt;"> </span><span style="color: black;"></span></p>
<p style="background: white; margin: 0in 0in 0pt; font-family: "Times New Roman","serif"; font-size: 12pt;">
<span style="color: black; font-family: "Calibri","sans-serif"; font-size: 11pt;">I would like to inform you that Microsoft has made update to its SHA-1 deprecation policy to accommodate developers targeting Vista/Server 2008. Please see below.</span><span style="color: black;"></span></p>
<p style="background: white; margin: 0in 0in 0pt; font-family: "Times New Roman","serif"; font-size: 12pt;">
<span style="color: black; font-family: "Calibri","sans-serif"; font-size: 11pt;"> </span><span style="color: black;"></span></p>
<p style="background: white; margin: 0in 0in 0pt; font-family: "Times New Roman","serif"; font-size: 12pt;">
<span style="color: black; font-family: "Calibri","sans-serif"; font-size: 11pt;"><a style="color: blue; text-decoration: underline;" href="http://blogs.technet.com/b/pki/archive/2013/11/12/sha1-deprecation-policy.aspx">http://blogs.technet.com/b/pki/archive/2013/11/12/sha1-deprecation-policy.aspx</a>
</span><span style="color: black;"></span></p>
<p style="background: white; margin: 0in 0in 0pt; font-family: "Times New Roman","serif"; font-size: 12pt;">
<span style="color: black; font-family: "Calibri","sans-serif"; font-size: 11pt;"> </span><span style="color: black;"></span></p>
<p style="background: white; margin: 0in 0in 0pt; font-family: "Times New Roman","serif"; font-size: 12pt;">
<span style="color: black; font-family: "Calibri","sans-serif"; font-size: 11pt;">Anoosh</span><span style="color: black;"></span></p>
<p style="background: white; margin: 0in 0in 0pt; font-family: "Times New Roman","serif"; font-size: 12pt;">
<span style="color: black; font-family: "Calibri","sans-serif"; font-size: 11pt;"> </span><span style="color: black;"></span></p>
</div>
</blockquote>
<blockquote style="margin-top: 5pt; margin-bottom: 5pt;">
<div>
<p style="background: white; margin: 0in 0in 0pt; font-family: "Times New Roman","serif"; font-size: 12pt;">
<span style="color: black;">_______________________________________________<br>
Public mailing list<br>
<a style="color: blue; text-decoration: underline;" href="mailto:Public@cabforum.org">Public@cabforum.org</a><br>
<a style="color: blue; text-decoration: underline;" href="https://cabforum.org/mailman/listinfo/public">https://cabforum.org/mailman/listinfo/public</a></span></p>
</div>
</blockquote>
<p style="background: white; margin: 0in 0in 0pt; font-family: "Times New Roman","serif"; font-size: 12pt;">
<span style="color: black;"><br>
<br>
</span></p>
<pre style="background: white; margin: 0in 0in 0pt; font-family: "Courier New"; font-size: 10pt;"><span style="color: black;">_______________________________________________</span></pre>
<pre style="background: white; margin: 0in 0in 0pt; font-family: "Courier New"; font-size: 10pt;"><span style="color: black;">Public mailing list</span></pre>
<pre style="background: white; margin: 0in 0in 0pt; font-family: "Courier New"; font-size: 10pt;"><span style="color: black;"><a style="color: blue; text-decoration: underline;" href="mailto:Public@cabforum.org">Public@cabforum.org</a></span></pre>
<pre style="background: white; margin: 0in 0in 0pt; font-family: "Courier New"; font-size: 10pt;"><span style="color: black;"><a style="color: blue; text-decoration: underline;" href="https://cabforum.org/mailman/listinfo/public">https://cabforum.org/mailman/listinfo/public</a></span></pre>
</blockquote>
<p style="background: white; margin: 0in 0in 0pt; font-family: "Times New Roman","serif"; font-size: 12pt;">
<span style="color: black;"> </span></p>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</body>
</html>