<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2//EN">
<HTML>
<HEAD>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=us-ascii">
<META NAME="Generator" CONTENT="MS Exchange Server version 14.02.5004.000">
<TITLE>CAB Forum Policy Change request</TITLE>
</HEAD>
<BODY>
<!-- Converted from text/rtf format -->
<P DIR=LTR><SPAN LANG="en-us"></SPAN><SPAN LANG="en-us"><FONT FACE="Calibri">Reposting to the Public list, with permission</FONT></SPAN><SPAN LANG="en-us"></SPAN><SPAN LANG="en-us"><FONT FACE="Calibri"> by the author</FONT></SPAN><SPAN LANG="en-us"></SPAN><SPAN LANG="en-us"><FONT FACE="Calibri">.</FONT></SPAN><SPAN LANG="en-us"></SPAN><SPAN LANG="en-us"></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"></SPAN><SPAN LANG="en-us"></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"></SPAN><SPAN LANG="en-us"><FONT FACE="Calibri">CAB Browser Forum,</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Calibri"> </FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Calibri">This message is from the AT&T Services, Inc., Chief Security Office, Data Protection Team. </FONT></SPAN><SPAN LANG="en-us"><FONT FACE="Calibri"> </FONT></SPAN><SPAN LANG="en-us"></SPAN><SPAN LANG="en-us"></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Calibri"> </FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><B></B></SPAN><SPAN LANG="en-us"><B><FONT FACE="Calibri">ISSUE</FONT></B></SPAN><SPAN LANG="en-us"></SPAN><SPAN LANG="en-us"></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Calibri">We are writing about the SHA-1 deprecation policy that all trusted Internet Certification Authorities must comply. Our specific concern is the December 31, 2015 deadline for obtaining SHA-1 server certificates. This timeframe does not allow flexibility for our applications running SHA-1 certificates now with migration plans for the SHA-256 upgrade in 2016.</FONT></SPAN><SPAN LANG="en-us"><FONT FACE="Calibri"> </FONT></SPAN><SPAN LANG="en-us"></SPAN><SPAN LANG="en-us"></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Calibri"> </FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Calibri"> </FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><B></B></SPAN><SPAN LANG="en-us"><B><FONT FACE="Calibri">BACKGROUND</FONT></B></SPAN><SPAN LANG="en-us"></SPAN><SPAN LANG="en-us"></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Calibri">We understand all CA issued SHA-1 certificates must expire by 12/31/2016 to comply with the Microsoft Windows Root Certificate Program technical requirements disabling Windows SHA-1 support in 2017. </FONT></SPAN><SPAN LANG="en-us"><FONT FACE="Calibri"> </FONT></SPAN><SPAN LANG="en-us"></SPAN><SPAN LANG="en-us"></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Calibri"> </FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"></SPAN><SPAN LANG="en-us"><FONT FACE="Calibri">Please note at:</FONT></SPAN><SPAN LANG="en-us"><FONT FACE="Calibri"> </FONT></SPAN><SPAN LANG="en-us"></SPAN><A HREF="https://urldefense.proofpoint.com/v2/url?u=http-3A__social.technet.microsoft.com_wiki_contents_articles_31633.microsoft-2Dtrusted-2Droot-2Dprogram-2Drequirements.aspx&d=BQMFAg&c=eEvniauFctOgLOKGJOplqw&r=bPeNvovSv0L4jj3hFD6Tw5sI3rGGNujxDceaEaUPuUQ&m=ZAkCyRUyNPWbkd0s3fkfjeZO8EmFbGVXhmSu5qjGlhc&s=c3bbI7UNyV1nTqGsbjW4HHr-KlCS37HhfXpIPnpZHSo&e="><SPAN LANG="en-us"></SPAN><SPAN LANG="en-us"><U><FONT COLOR="#0000FF" FACE="Calibri">http://social.technet.microsoft.com/wiki/contents/articles/31633.microsoft-trusted-root-program-requirements.aspx</FONT></U></SPAN><SPAN LANG="en-us"></SPAN></A><SPAN LANG="en-us"></SPAN><SPAN LANG="en-us"><FONT FACE="Calibri"> </FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Calibri"> </FONT></SPAN><SPAN LANG="en-us"></SPAN><SPAN LANG="en-us"></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Calibri">Symantec, our Certification Authority (CA) vendor, confirmed in 2014 that we would retain the option to issue SHA-1 certificates in 2016 with expiration no later than 12/31/2016, for:</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Calibri"> </FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"></SPAN><SPAN LANG="en-us"><FONT FACE="Calibri">1)</FONT></SPAN><SPAN LANG="en-us"></SPAN><SPAN LANG="en-us"><FONT SIZE=1 FACE="Calibri"> </FONT></SPAN><SPAN LANG="en-us"></SPAN><SPAN LANG="en-us"><FONT SIZE=1 FACE="Calibri"> </FONT></SPAN><SPAN LANG="en-us"></SPAN><SPAN LANG="en-us"><FONT FACE="Calibri">Our applications that can’t upgrade in 2015 and need new or renewal SHA-1 certificates for part of 2016.</FONT></SPAN><SPAN LANG="en-us"><FONT FACE="Calibri"> </FONT></SPAN><SPAN LANG="en-us"></SPAN><SPAN LANG="en-us"></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Calibri"> </FONT></SPAN><SPAN LANG="en-us"></SPAN><SPAN LANG="en-us"></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"></SPAN><SPAN LANG="en-us"><FONT FACE="Calibri">2)</FONT></SPAN><SPAN LANG="en-us"></SPAN><SPAN LANG="en-us"><FONT SIZE=1 FACE="Calibri"> </FONT></SPAN><SPAN LANG="en-us"></SPAN><SPAN LANG="en-us"><FONT SIZE=1 FACE="Calibri"> </FONT></SPAN><SPAN LANG="en-us"></SPAN><SPAN LANG="en-us"><FONT FACE="Calibri">Continued support of legacy applications scheduled to retire in 2016 which need SHA-1 certificate renewal.</FONT></SPAN><SPAN LANG="en-us"><FONT FACE="Calibri"> </FONT></SPAN><SPAN LANG="en-us"></SPAN><SPAN LANG="en-us"></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Calibri"> </FONT></SPAN><SPAN LANG="en-us"></SPAN><SPAN LANG="en-us"></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Calibri">We successfully migrated to 2048-bit encryption keys using this method during the last PKI industry standard change and were assured the same option would be available for the SHA-256 migration in 2016.</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Calibri"> </FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Calibri"> </FONT></SPAN><SPAN LANG="en-us"></SPAN><SPAN LANG="en-us"></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><B></B></SPAN><SPAN LANG="en-us"><B><FONT FACE="Calibri">NEGATIVE BUSINESS IMPACTS</FONT></B></SPAN><SPAN LANG="en-us"></SPAN><SPAN LANG="en-us"></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Calibri">Symantec recommended issuing all SHA-1 certificates that expire in 2016 by the end of 2015. This interim solution is not feasible to implement for multiple reasons:</FONT></SPAN><SPAN LANG="en-us"><FONT FACE="Calibri"> </FONT></SPAN><SPAN LANG="en-us"></SPAN><SPAN LANG="en-us"></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Calibri"> </FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Calibri">1) Symantec’s proposal involves changing thousands of SHA-1 certificates that will translate to a high volume of unplanned operations and workload churn. Specifically, the operational complexities of tracking server key store changes followed by the secondary labor intensive task to manually revoke each decommissioned certificate. PKI security isn’t strengthened by limiting SHA-1 certificate issuance in 2016. We increase risk for private key compromise by leaving decommissioned but valid key pairs scattered across many servers pending revokes.</FONT></SPAN><SPAN LANG="en-us"><FONT FACE="Calibri"> </FONT></SPAN><SPAN LANG="en-us"></SPAN><SPAN LANG="en-us"></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Calibri"> </FONT></SPAN><SPAN LANG="en-us"></SPAN><SPAN LANG="en-us"></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Calibri">2) AT&T freezes non-emergency changes from mid-November through mid-January for zero customer service disruptions during the holidays. Technically we have less than three months to migrate the remaining SHA-1 certificates which equates to thousands of certificates. Three months does not provide sufficient time to deploy Symantec’s solution.</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Calibri"> </FONT></SPAN><SPAN LANG="en-us"></SPAN><SPAN LANG="en-us"></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"></SPAN><SPAN LANG="en-us"><FONT FACE="Calibri">3) Some applications can’t upgrade to SHA-256 until early to mid-2016 when vendor supported software is available.</FONT></SPAN><SPAN LANG="en-us"><FONT FACE="Calibri"> </FONT></SPAN><SPAN LANG="en-us"></SPAN><SPAN LANG="en-us"></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Calibri"> </FONT></SPAN><SPAN LANG="en-us"></SPAN><SPAN LANG="en-us"></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"></SPAN><SPAN LANG="en-us"><FONT FACE="Calibri">4) Many applications committed to firm 2016 deployment plans and resource allocations for this change and can’t migrate before 12/31/2015 due to current ongoing commitments.</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Calibri"> </FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Calibri"> </FONT></SPAN><SPAN LANG="en-us"></SPAN><SPAN LANG="en-us"></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><B></B></SPAN><SPAN LANG="en-us"><B><FONT FACE="Calibri">RESOLUTION</FONT></B></SPAN><SPAN LANG="en-us"></SPAN><SPAN LANG="en-us"></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Calibri"> </FONT></SPAN><SPAN LANG="en-us"></SPAN><SPAN LANG="en-us"></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Calibri">We request a policy change allowing Symantec to continue issuing less-than-one-year SHA-1 certificates after 12/31/2015 under their public trusted PKI hierarchy to support our remaining applications scheduled for SHA-256 adoption or retirement in 2016. </FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Calibri"> </FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Calibri">We must retain the option to issue SHA-1 certificates in 2016, with expiration no later than December 31, 2016, for enrollments, renewals and replacements to support uninterrupted production services. </FONT></SPAN><SPAN LANG="en-us"><FONT FACE="Calibri"> </FONT></SPAN><SPAN LANG="en-us"></SPAN><SPAN LANG="en-us"></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Calibri"> </FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Calibri">In closing, we agree with the CA Browser Forum’s intent but do not agree with the execution of this high business impact policy change that will involve many software providers, hardware vendors and businesses.</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT COLOR="#1F497D" FACE="Calibri"> </FONT></SPAN><SPAN LANG="en-us"></SPAN><SPAN LANG="en-us"></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"></SPAN><SPAN LANG="en-us"><FONT COLOR="#1F497D" FACE="Calibri">Andrea</FONT></SPAN><SPAN LANG="en-us"></SPAN><SPAN LANG="en-us"></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"></SPAN><SPAN LANG="en-us"><FONT COLOR="#1F497D" FACE="Calibri"> </FONT></SPAN><SPAN LANG="en-us"></SPAN><SPAN LANG="en-us"></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><B></B></SPAN><SPAN LANG="en-us"><B></B></SPAN><SPAN LANG="en-us"><B><FONT COLOR="#FFC000" SIZE=2 FACE="Calibri">Andrea A. Wilemon, CISSP</FONT></B></SPAN><SPAN LANG="en-us"></SPAN><SPAN LANG="en-us"></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"></SPAN><SPAN LANG="en-us"></SPAN><SPAN LANG="en-us"><FONT COLOR="#1F497D" SIZE=2 FACE="Calibri">Principle-Technology Security</FONT></SPAN><SPAN LANG="en-us"></SPAN><SPAN LANG="en-us"></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Calibri"> </FONT></SPAN><SPAN LANG="en-us"></SPAN><SPAN LANG="en-us"></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><B><I></I></B></SPAN><SPAN LANG="en-us"><B><I></I></B></SPAN><SPAN LANG="en-us"><B><I><FONT COLOR="#4F81BD" SIZE=2 FACE="Calibri">Rethink Possible®</FONT></I></B></SPAN><SPAN LANG="en-us"><B><I></I></B></SPAN><SPAN LANG="en-us"><B><I><FONT COLOR="#4F81BD" SIZE=2 FACE="Calibri"> </FONT></I></B></SPAN><SPAN LANG="en-us"></SPAN><SPAN LANG="en-us"></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT COLOR="#666666" FACE="Calibri"> </FONT></SPAN><SPAN LANG="en-us"></SPAN><SPAN LANG="en-us"></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"></SPAN><SPAN LANG="en-us"></SPAN><SPAN LANG="en-us"><FONT COLOR="#1F497D" SIZE=2 FACE="Calibri">Chief Security Office, Mobility, Cloud & Enterprise Security</FONT></SPAN><SPAN LANG="en-us"></SPAN><SPAN LANG="en-us"></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><B></B></SPAN><SPAN LANG="en-us"><B></B></SPAN><SPAN LANG="en-us"><B><FONT COLOR="#FFC000" SIZE=2 FACE="Calibri">AT&T Services, Inc.</FONT></B></SPAN><SPAN LANG="en-us"></SPAN><SPAN LANG="en-us"></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT COLOR="#1F497D" FACE="Calibri"> </FONT></SPAN><SPAN LANG="en-us"></SPAN><SPAN LANG="en-us"></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"></SPAN><SPAN LANG="en-us"></SPAN><SPAN LANG="en-us"><FONT COLOR="#1F497D" SIZE=2 FACE="Calibri">P: 248-424-4115</FONT></SPAN><SPAN LANG="en-us"></SPAN><SPAN LANG="en-us"></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"></SPAN><A HREF="mailto:aw8139@att.com"><SPAN LANG="en-us"></SPAN><SPAN LANG="en-us"></SPAN><SPAN LANG="en-us"><U><FONT COLOR="#0000FF" SIZE=2 FACE="Calibri">aw8139@att.com</FONT></U></SPAN><SPAN LANG="en-us"></SPAN></A><SPAN LANG="en-us"></SPAN><SPAN LANG="en-us"></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT COLOR="#1F497D" FACE="Calibri"> </FONT></SPAN><SPAN LANG="en-us"></SPAN><SPAN LANG="en-us"></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"></SPAN><SPAN LANG="en-us"></SPAN><SPAN LANG="en-us"><FONT SIZE=2 FACE="Calibri">Send</FONT></SPAN><SPAN LANG="en-us"></SPAN><SPAN LANG="en-us"><FONT SIZE=2 FACE="Calibri"> </FONT></SPAN><SPAN LANG="en-us"><B></B></SPAN><SPAN LANG="en-us"><B></B></SPAN><SPAN LANG="en-us"><B><FONT SIZE=2 FACE="Calibri">#X</FONT></B></SPAN><SPAN LANG="en-us"><B></B></SPAN><SPAN LANG="en-us"><B><FONT SIZE=2 FACE="Calibri"> </FONT></B></SPAN><SPAN LANG="en-us"></SPAN><SPAN LANG="en-us"></SPAN><SPAN LANG="en-us"><FONT SIZE=2 FACE="Calibri">before you drive to pause the</FONT></SPAN><SPAN LANG="en-us"></SPAN><SPAN LANG="en-us"></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"></SPAN><SPAN LANG="en-us"></SPAN><SPAN LANG="en-us"><FONT SIZE=2 FACE="Calibri">conversation until you arrive.</FONT></SPAN><SPAN LANG="en-us"></SPAN><SPAN LANG="en-us"><FONT SIZE=2 FACE="Calibri"> </FONT></SPAN><SPAN LANG="en-us"></SPAN><SPAN LANG="en-us"></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"></SPAN><SPAN LANG="en-us"></SPAN><SPAN LANG="en-us"><FONT COLOR="#1F497D" SIZE=2 FACE="Calibri">Take the pledge... It Can Wait.</FONT></SPAN><SPAN LANG="en-us"></SPAN><SPAN LANG="en-us"></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"></SPAN><SPAN LANG="en-us"></SPAN><SPAN LANG="en-us"><FONT COLOR="#1F497D" SIZE=2 FACE="Calibri"> </FONT></SPAN><SPAN LANG="en-us"></SPAN><SPAN LANG="en-us"></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><I></I></SPAN><SPAN LANG="en-us"><I></I></SPAN><SPAN LANG="en-us"><I><FONT COLOR="#1F497D" SIZE=2 FACE="Calibri">This e-mail and any files transmitted with it are the property of AT&T, are confidential, and are intended solely for the use of the individual or entity to whom this e-mail is addressed. If you are not one of the named recipient(s) or otherwise have reason to believe that you have received this message in error, please notify the sender at 248-424-4115 and delete this message immediately from your computer. Any other use, retention, dissemination, forwarding, printing, or copying of this e-mail is strictly prohibited."</FONT></I></SPAN><SPAN LANG="en-us"></SPAN><SPAN LANG="en-us"></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"></SPAN><SPAN LANG="en-us"></SPAN><SPAN LANG="en-us"></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"></SPAN></P>
</BODY>
</HTML>