<html><head><meta http-equiv="Content-Type" content="text/html charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">Slightly higher.<div class="">There’s sadly no demonstrated collision on SHA1 yet, and since all public CAs are good actors and add some entropy in the beginning of the certificate as indicated by the BR (isn’t it right?), a random prefix collision on SHA1 is further away.</div><div class=""><br class=""></div><div class="">I’m not saying I support this proposal.</div><div class=""><br class=""><div class="">
<div class="">Cordialement,</div><div class="">Erwann Abalea</div><div class=""><br class=""></div><br class="Apple-interchange-newline">
</div>
<br class=""><div><blockquote type="cite" class=""><div class="">Le 3 sept. 2015 à 14:06, Bruce Morton <<a href="mailto:bruce.morton@entrust.com" class="">bruce.morton@entrust.com</a>> a écrit :</div><br class="Apple-interchange-newline"><div class=""><div class="WordSection1" style="page: WordSection1; font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;"><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class="">Kirk,<o:p class=""></o:p></span></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class=""> </span></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class="">I think the risk is higher. A hash collision attack happens at the time of certificate issuance. The proposal would add an additional year for a collision attack to take place.<o:p class=""></o:p></span></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class=""> </span></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class="">Bruce.<o:p class=""></o:p></span></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class=""> </span></div><div class=""><div style="border-style: solid none none; border-top-color: rgb(225, 225, 225); border-top-width: 1pt; padding: 3pt 0in 0in;" class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><b class=""><span style="font-size: 11pt; font-family: Calibri, sans-serif;" class="">From:</span></b><span style="font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span class="Apple-converted-space"> </span><a href="mailto:public-bounces@cabforum.org" class="">public-bounces@cabforum.org</a> [<a href="mailto:public-bounces@cabforum.org" class="">mailto:public-bounces@cabforum.org</a>]<span class="Apple-converted-space"> </span><b class="">On Behalf Of<span class="Apple-converted-space"> </span></b><a href="mailto:kirk_hall@trendmicro.com" class="">kirk_hall@trendmicro.com</a><br class=""><b class="">Sent:</b><span class="Apple-converted-space"> </span>Thursday, September 3, 2015 1:48 AM<br class=""><b class="">To:</b><span class="Apple-converted-space"> </span>CABFPub (public@cabforum.org) <public@cabforum.org><br class=""><b class="">Subject:</b><span class="Apple-converted-space"> </span>[cabfpub] CAB Forum Policy Change request<o:p class=""></o:p></span></div></div></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><o:p class=""> </o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span style="font-size: 11pt; font-family: Calibri, sans-serif;" class="">Reposting to public list. <o:p class=""></o:p></span></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span style="font-size: 11pt; font-family: Calibri, sans-serif;" class=""> </span></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span style="font-size: 11pt; font-family: Calibri, sans-serif;" class="">We support the proposal, as it doesn’t appear to have a different result than current policy under the Baseline Requirements – SHA-1 certs can continue so long as they expire on or before Jan. 1, 2017. What difference does it make whether the cert was issued before or after Jan. 1, 2016 – the security risk is the same.<o:p class=""></o:p></span></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span style="font-size: 11pt; font-family: Calibri, sans-serif;" class=""> </span></div><div class=""><div style="border-style: solid none none; border-top-color: rgb(225, 225, 225); border-top-width: 1pt; padding: 3pt 0in 0in;" class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><b class=""><span style="font-size: 11pt; font-family: Calibri, sans-serif;" class="">From:</span></b><span style="font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span class="Apple-converted-space"> </span>Kirk Hall (RD-US)<span class="Apple-converted-space"> </span><br class=""><b class="">Sent:</b><span class="Apple-converted-space"> </span>Wednesday, September 02, 2015 1:54 PM<br class=""><b class="">To:</b><span class="Apple-converted-space"> </span>'Rick Andrews';<span class="Apple-converted-space"> </span><a href="mailto:management@cabforum.org" style="color: purple; text-decoration: underline;" class="">management@cabforum.org</a><br class=""><b class="">Cc:</b><span class="Apple-converted-space"> </span>Mark Kelly; Shannon Ortiz<br class=""><b class="">Subject:</b><span class="Apple-converted-space"> </span>RE: [cabfquest] CAB Forum Policy Change request<o:p class=""></o:p></span></div></div></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><o:p class=""> </o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span style="font-size: 11pt; font-family: Calibri, sans-serif;" class="">While we have not received such customer requests, Trend Micro would support this to handle legacy customer issues. The certs could (would) be deprecated in the browsers as they choose, but if the customer is willing to deal with that and knows of potential risks, we don’t see a big difference between a SHA-1 cert issued on 12/31/2015 and expiring on 1/1/2017 versus a SHA-1 cert issued on Jan. 1, 2016 (or March 1, or July 1) and expiring on 1/1/2017. Seems like the level of risk is about the same for all these cases.<o:p class=""></o:p></span></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span style="font-size: 11pt; font-family: Calibri, sans-serif;" class=""> </span></div><div class=""><div style="border-style: solid none none; border-top-color: rgb(225, 225, 225); border-top-width: 1pt; padding: 3pt 0in 0in;" class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><b class=""><span style="font-size: 11pt; font-family: Calibri, sans-serif;" class="">From:</span></b><span style="font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span class="Apple-converted-space"> </span><a href="mailto:management-bounces@cabforum.org" style="color: purple; text-decoration: underline;" class="">management-bounces@cabforum.org</a><span class="Apple-converted-space"> </span>[<a href="mailto:management-bounces@cabforum.org" style="color: purple; text-decoration: underline;" class="">mailto:management-bounces@cabforum.org</a>]<b class="">On Behalf Of<span class="Apple-converted-space"> </span></b>Rick Andrews<br class=""><b class="">Sent:</b><span class="Apple-converted-space"> </span>Wednesday, September 02, 2015 1:47 PM<br class=""><b class="">To:</b><span class="Apple-converted-space"> </span><a href="mailto:management@cabforum.org" style="color: purple; text-decoration: underline;" class="">management@cabforum.org</a><br class=""><b class="">Cc:</b><span class="Apple-converted-space"> </span>Mark Kelly; Shannon Ortiz<br class=""><b class="">Subject:</b><span class="Apple-converted-space"> </span>Re: [cabfman] [cabfquest] CAB Forum Policy Change request<o:p class=""></o:p></span></div></div></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><o:p class=""> </o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class="">Removing AT&T for the moment, and posting to the Management list instead of the Questions list.<o:p class=""></o:p></span></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class=""> </span></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class="">I believe that to meet AT&T’s needs, we’d simply need to remove this sentence from the BRs: “Effective 1 January 2016, CAs MUST NOT issue any new Subscriber certificates or Subordinate CA certificates using the SHA‐1 hash algorithm.” We would still be left with “CAs SHOULD NOT issue Subscriber Certificates utilizing the SHA‐1 algorithm with an Expiry Date greater than 1 January 2017.” We could even change the SHOULD NOT in that sentence to MUST.<span class="Apple-converted-space"> </span><o:p class=""></o:p></span></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class=""> </span></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class="">It’s essentially the same as a proposal that I made to Tom Albertson of Microsoft a while ago when he first started discussing SHA-1 deprecation. I said that in the past, we’d had customers complain strongly about arbitrary deadlines that are difficult for them to meet, especially when those deadlines are at the end of December, a time when many companies freeze their infrastructures. Giving CAs and customers the ability to get progressively shorter certs until the final 2017 deadline helps customers a lot. Tom’s opposition was that it allows for more SHA-1 certs to be created, but I would argue that it’s a compromise that would go a long way to achieving the ultimate goal with much less business disruption.<o:p class=""></o:p></span></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class=""> </span></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class="">Symantec would like to be able to help customers such as AT&T without violating the BRs and receiving a qualified audit next year.<o:p class=""></o:p></span></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class=""> </span></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class="">-Rick<o:p class=""></o:p></span></div><div class=""><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><o:p class=""> </o:p></div></div></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><o:p class=""> </o:p></div><div class=""><blockquote style="margin-top: 5pt; margin-bottom: 5pt;" class=""><div class=""><div style="margin: 0in 0in 0.0001pt 0.5in; font-size: 12pt; font-family: 'Times New Roman', serif;" class="">On Aug 31, 2015, at 4:26 PM, WILEMON, ANDREA A <<a href="mailto:aw8139@att.com" style="color: purple; text-decoration: underline;" class="">aw8139@att.com</a>> wrote:<o:p class=""></o:p></div></div><div style="margin: 0in 0in 0.0001pt 0.5in; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><o:p class=""> </o:p></div><div class=""><div class=""><div style="margin: 0in 0in 0.0001pt 0.5in; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span style="font-size: 11pt; font-family: Calibri, sans-serif;" class="">CAB Browser Forum,<o:p class=""></o:p></span></div></div><div class=""><div style="margin: 0in 0in 0.0001pt 0.5in; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span style="font-size: 11pt; font-family: Calibri, sans-serif;" class=""> <o:p class=""></o:p></span></div></div><div class=""><div style="margin: 0in 0in 0.0001pt 0.5in; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span style="font-size: 11pt; font-family: Calibri, sans-serif;" class="">This message is from the AT&T Services, Inc., Chief Security Office, Data Protection Team. <span class="apple-converted-space"> </span><o:p class=""></o:p></span></div></div><div class=""><div style="margin: 0in 0in 0.0001pt 0.5in; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span style="font-size: 11pt; font-family: Calibri, sans-serif;" class=""> <o:p class=""></o:p></span></div></div><div class=""><div style="margin: 0in 0in 0.0001pt 0.5in; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><b class=""><span style="font-size: 11pt; font-family: Calibri, sans-serif;" class="">ISSUE</span></b><span style="font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""></o:p></span></div></div><div class=""><div style="margin: 0in 0in 0.0001pt 0.5in; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span style="font-size: 11pt; font-family: Calibri, sans-serif;" class="">We are writing about the SHA-1 depreciation policy that all trusted Internet Certification Authorities must comply. Our specific concern is the December 31, 2015 deadline for obtaining SHA-1 server certificates. This timeframe does not allow flexibility for our applications running SHA-1 certificates now with migration plans for the SHA-256 upgrade in 2016.<span class="apple-converted-space"> </span><o:p class=""></o:p></span></div></div><div class=""><div style="margin: 0in 0in 0.0001pt 0.5in; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span style="font-size: 11pt; font-family: Calibri, sans-serif;" class=""> <o:p class=""></o:p></span></div></div><div class=""><div style="margin: 0in 0in 0.0001pt 0.5in; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span style="font-size: 11pt; font-family: Calibri, sans-serif;" class=""> <o:p class=""></o:p></span></div></div><div class=""><div style="margin: 0in 0in 0.0001pt 0.5in; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><b class=""><span style="font-size: 11pt; font-family: Calibri, sans-serif;" class="">BACKGROUND</span></b><span style="font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""></o:p></span></div></div><div class=""><div style="margin: 0in 0in 0.0001pt 0.5in; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span style="font-size: 11pt; font-family: Calibri, sans-serif;" class="">We understand all CA issued SHA-1 certificates must expire by 12/31/2016 to comply with the Microsoft Windows Root Certificate Program technical requirements disabling Windows SHA-1 support in 2017. <span class="apple-converted-space"> </span><o:p class=""></o:p></span></div></div><div class=""><div style="margin: 0in 0in 0.0001pt 0.5in; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span style="font-size: 11pt; font-family: Calibri, sans-serif;" class=""> <o:p class=""></o:p></span></div></div><div class=""><div style="margin: 0in 0in 0.0001pt 0.5in; font-size: 12pt; font-family: 'Times New Roman', serif; text-indent: 0.5in;" class=""><span style="font-size: 11pt; font-family: Calibri, sans-serif;" class="">Please note at:<span class="apple-converted-space"> </span><a href="https://urldefense.proofpoint.com/v2/url?u=http-3A__social.technet.microsoft.com_wiki_contents_articles_31633.microsoft-2Dtrusted-2Droot-2Dprogram-2Drequirements.aspx&d=BQMFAg&c=eEvniauFctOgLOKGJOplqw&r=bPeNvovSv0L4jj3hFD6Tw5sI3rGGNujxDceaEaUPuUQ&m=ZAkCyRUyNPWbkd0s3fkfjeZO8EmFbGVXhmSu5qjGlhc&s=c3bbI7UNyV1nTqGsbjW4HHr-KlCS37HhfXpIPnpZHSo&e=" style="color: purple; text-decoration: underline;" class="">http://social.technet.microsoft.com/wiki/contents/articles/31633.microsoft-trusted-root-program-requirements.aspx</a> <o:p class=""></o:p></span></div></div><div class=""><div style="margin: 0in 0in 0.0001pt 0.5in; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""> <span style="font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""></o:p></span></div></div><div class=""><div style="margin: 0in 0in 0.0001pt 0.5in; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span style="font-size: 11pt; font-family: Calibri, sans-serif;" class="">Symantec, our Certification Authority (CA) vendor, confirmed in 2014 that we would retain the option to issue SHA-1 certificates in 2016 with expiration no later than 12/31/2016, for:<o:p class=""></o:p></span></div></div><div class=""><div style="margin: 0in 0in 0.0001pt 0.5in; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span style="font-size: 11pt; font-family: Calibri, sans-serif;" class=""> <o:p class=""></o:p></span></div></div><div class=""><div style="margin: 0in 0in 0.0001pt 0.5in; font-size: 12pt; font-family: 'Times New Roman', serif; text-indent: -0.25in;" class=""><span style="font-size: 11pt; font-family: Calibri, sans-serif;" class="">1)</span><span style="font-size: 7pt;" class=""> <span class="apple-converted-space"> </span></span><span style="font-size: 11pt; font-family: Calibri, sans-serif;" class="">Our applications that can’t upgrade in 2015 and need new or renewal SHA-1 certificates for part of 2016.<span class="apple-converted-space"> </span><o:p class=""></o:p></span></div></div><div class=""><div style="margin: 0in 0in 0.0001pt 0.5in; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""> <span style="font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""></o:p></span></div></div><div class=""><div style="margin: 0in 0in 0.0001pt 0.5in; font-size: 12pt; font-family: 'Times New Roman', serif; text-indent: -0.25in;" class=""><span style="font-size: 11pt; font-family: Calibri, sans-serif;" class="">2)</span><span style="font-size: 7pt;" class=""> <span class="apple-converted-space"> </span></span><span style="font-size: 11pt; font-family: Calibri, sans-serif;" class="">Continued support of legacy applications scheduled to retire in 2016 which need SHA-1 certificate renewal.<span class="apple-converted-space"> </span><o:p class=""></o:p></span></div></div><div class=""><div style="margin: 0in 0in 0.0001pt 0.5in; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""> <span style="font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""></o:p></span></div></div><div class=""><div style="margin: 0in 0in 0.0001pt 0.5in; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span style="font-size: 11pt; font-family: Calibri, sans-serif;" class="">We successfully migrated to 2048-bit encryption keys using this method during the last PKI industry standard change and were assured the same option would be available for the SHA-256 migration in 2016.<o:p class=""></o:p></span></div></div><div class=""><div style="margin: 0in 0in 0.0001pt 0.5in; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span style="font-size: 11pt; font-family: Calibri, sans-serif;" class=""> <o:p class=""></o:p></span></div></div><div class=""><div style="margin: 0in 0in 0.0001pt 0.5in; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""> <span style="font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""></o:p></span></div></div><div class=""><div style="margin: 0in 0in 0.0001pt 0.5in; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><b class=""><span style="font-size: 11pt; font-family: Calibri, sans-serif;" class="">NEGATIVE BUSINESS IMPACTS</span></b><span style="font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""></o:p></span></div></div><div class=""><div style="margin: 0in 0in 0.0001pt 0.5in; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span style="font-size: 11pt; font-family: Calibri, sans-serif;" class="">Symantec recommended issuing all SHA-1 certificates that expire in 2016 by the end of 2015. This interim solution is not feasible to implement for multiple reasons:<span class="apple-converted-space"> </span><o:p class=""></o:p></span></div></div><div class=""><div style="margin: 0in 0in 0.0001pt 0.5in; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span style="font-size: 11pt; font-family: Calibri, sans-serif;" class=""> <o:p class=""></o:p></span></div></div><div class=""><div style="margin: 0in 0in 0.0001pt 0.5in; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span style="font-size: 11pt; font-family: Calibri, sans-serif;" class="">1) Symantec’s proposal involves changing thousands of SHA-1 certificates that will translate to a high volume of unplanned operations and workload churn. Specifically, the operational complexities of tracking server key store changes followed by the secondary labor intensive task to manually revoke each decommissioned certificate. PKI security isn’t strengthened by limiting SHA-1 certificate issuance in 2016. We increase risk for private key compromise by leaving decommissioned but valid key pairs scattered across many servers pending revokes.<span class="apple-converted-space"> </span><o:p class=""></o:p></span></div></div><div class=""><div style="margin: 0in 0in 0.0001pt 0.5in; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""> <span style="font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""></o:p></span></div></div><div class=""><div style="margin: 0in 0in 0.0001pt 0.5in; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span style="font-size: 11pt; font-family: Calibri, sans-serif;" class="">2) AT&T freezes non-emergency changes from mid-November through mid-January for zero customer service disruptions during the holidays. Technically we have less than three months to migrate the remaining SHA-1 certificates which equates to thousands of certificates. Three months does not provide sufficient time to deploy Symantec’s solution.<o:p class=""></o:p></span></div></div><div class=""><div style="margin: 0in 0in 0.0001pt 0.5in; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""> <span style="font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""></o:p></span></div></div><div class=""><div style="margin: 0in 0in 0.0001pt 0.5in; font-size: 12pt; font-family: 'Times New Roman', serif; text-indent: 0.5in;" class=""><span style="font-size: 11pt; font-family: Calibri, sans-serif;" class="">3) Some applications can’t upgrade to SHA-256 until early to mid-2016 when vendor supported software is available.<span class="apple-converted-space"> </span><o:p class=""></o:p></span></div></div><div class=""><div style="margin: 0in 0in 0.0001pt 0.5in; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""> <span style="font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""></o:p></span></div></div><div class=""><div style="margin: 0in 0in 0.0001pt 0.5in; font-size: 12pt; font-family: 'Times New Roman', serif; text-indent: 0.5in;" class=""><span style="font-size: 11pt; font-family: Calibri, sans-serif;" class="">4) Many applications committed to firm 2016 deployment plans and resource allocations for this change and can’t migrate before 12/31/2015 due to current ongoing commitments.<o:p class=""></o:p></span></div></div><div class=""><div style="margin: 0in 0in 0.0001pt 0.5in; font-size: 12pt; font-family: 'Times New Roman', serif; text-indent: 0.5in;" class=""><span style="font-size: 11pt; font-family: Calibri, sans-serif;" class=""> <o:p class=""></o:p></span></div></div><div class=""><div style="margin: 0in 0in 0.0001pt 0.5in; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""> <span style="font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""></o:p></span></div></div><div class=""><div style="margin: 0in 0in 0.0001pt 0.5in; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><b class=""><span style="font-size: 11pt; font-family: Calibri, sans-serif;" class="">RESOLUTION</span></b><span style="font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""></o:p></span></div></div><div class=""><div style="margin: 0in 0in 0.0001pt 0.5in; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""> <span style="font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""></o:p></span></div></div><div class=""><div style="margin: 0in 0in 0.0001pt 0.5in; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span style="font-size: 11pt; font-family: Calibri, sans-serif;" class="">We request a policy change allowing Symantec to continue issuing less-than-one-year SHA-1 certificates after 12/31/2015 under their public trusted PKI hierarchy to support our remaining applications scheduled for SHA-256 adoption or retirement in 2016. <o:p class=""></o:p></span></div></div><div class=""><div style="margin: 0in 0in 0.0001pt 0.5in; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span style="font-size: 11pt; font-family: Calibri, sans-serif;" class=""> <o:p class=""></o:p></span></div></div><div class=""><div style="margin: 0in 0in 0.0001pt 0.5in; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span style="font-size: 11pt; font-family: Calibri, sans-serif;" class="">We must retain the option to issue SHA-1 certificates in 2016, with expiration no later than December 31, 2016, for enrollments, renewals and replacements to support uninterrupted production services. <span class="apple-converted-space"> </span><o:p class=""></o:p></span></div></div><div class=""><div style="margin: 0in 0in 0.0001pt 0.5in; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span style="font-size: 11pt; font-family: Calibri, sans-serif;" class=""> <o:p class=""></o:p></span></div></div><div class=""><div style="margin: 0in 0in 0.0001pt 0.5in; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span style="font-size: 11pt; font-family: Calibri, sans-serif;" class="">In closing, we agree with the CA Browser Forum’s intent but do not agree with the execution of this high business impact policy change that will involve many software providers, hardware vendors and businesses.<o:p class=""></o:p></span></div></div><div class=""><div style="margin: 0in 0in 0.0001pt 0.5in; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span style="color: rgb(31, 73, 125);" class=""> </span><span style="font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""></o:p></span></div></div><div class=""><div style="margin: 0in 0in 0.0001pt 0.5in; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class="">Andrea</span><span style="font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""></o:p></span></div></div><div class=""><div style="margin: 0in 0in 0.0001pt 0.5in; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class=""> </span><span style="font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""></o:p></span></div></div><div class=""><div style="margin: 0in 0in 0.0001pt 0.5in; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><b class=""><span style="font-size: 10pt; font-family: Calibri, sans-serif; color: rgb(255, 192, 0);" class="">Andrea A. Wilemon, CISSP</span></b><span style="font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""></o:p></span></div></div><div class=""><div style="margin: 0in 0in 0.0001pt 0.5in; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span style="font-size: 10pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class="">Principle-Technology Security</span><span style="font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""></o:p></span></div></div><div class=""><div style="margin: 0in 0in 0.0001pt 0.5in; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""> <span style="font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""></o:p></span></div></div><div class=""><div style="margin: 0in 0in 0.0001pt 0.5in; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><b class=""><i class=""><span style="font-size: 10pt; font-family: Calibri, sans-serif; color: rgb(79, 129, 189);" class="">Rethink Possible®<span class="apple-converted-space"> </span></span></i></b><span style="font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""></o:p></span></div></div><div class=""><div style="margin: 0in 0in 0.0001pt 0.5in; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span style="color: rgb(102, 102, 102);" class=""> </span><span style="font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""></o:p></span></div></div><div class=""><div style="margin: 0in 0in 0.0001pt 0.5in; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span style="font-size: 10pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class="">Chief Security Office, Mobility, Cloud & Enterprise Security</span><span style="font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""></o:p></span></div></div><div class=""><div style="margin: 0in 0in 0.0001pt 0.5in; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><b class=""><span style="font-size: 10pt; font-family: Calibri, sans-serif; color: rgb(255, 192, 0);" class="">AT&T Services, Inc.</span></b><span style="font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""></o:p></span></div></div><div class=""><div style="margin: 0in 0in 0.0001pt 0.5in; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span style="color: rgb(31, 73, 125);" class=""> </span><span style="font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""></o:p></span></div></div><div class=""><div style="margin: 0in 0in 0.0001pt 0.5in; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span style="font-size: 10pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class="">P: 248-424-4115</span><span style="font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""></o:p></span></div></div><div class=""><div style="margin: 0in 0in 0.0001pt 0.5in; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><a href="mailto:aw8139@att.com" style="color: purple; text-decoration: underline;" class=""><span style="font-size: 10pt; font-family: Calibri, sans-serif;" class="">aw8139@att.com</span></a><span style="font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""></o:p></span></div></div><div class=""><div style="margin: 0in 0in 0.0001pt 0.5in; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span style="color: rgb(31, 73, 125);" class=""> </span><span style="font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""></o:p></span></div></div><div class=""><div style="margin: 0in 0in 0.0001pt 0.5in; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span style="font-size: 10pt; font-family: Calibri, sans-serif;" class="">Send<span class="apple-converted-space"> </span><b class="">#X<span class="apple-converted-space"> </span></b>before you drive to pause the</span><span style="font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""></o:p></span></div></div><div class=""><div style="margin: 0in 0in 0.0001pt 0.5in; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span style="font-size: 10pt; font-family: Calibri, sans-serif;" class="">conversation until you arrive.<span class="apple-converted-space"> </span></span><span style="font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""></o:p></span></div></div><div class=""><div style="margin: 0in 0in 0.0001pt 0.5in; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span style="font-size: 10pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class="">Take the pledge... It Can Wait.</span><span style="font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""></o:p></span></div></div><div class=""><div style="margin: 0in 0in 0.0001pt 0.5in; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span style="font-size: 10pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class=""> </span><span style="font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""></o:p></span></div></div><div class=""><div style="margin: 0in 0in 0.0001pt 0.5in; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><i class=""><span style="font-size: 10pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class="">This e-mail and any files transmitted with it are the property of AT&T, are confidential, and are intended solely for the use of the individual or entity to whom this e-mail is addressed. If you are not one of the named recipient(s) or otherwise have reason to believe that you have received this message in error, please notify the sender at 248-424-4115 and delete this message immediately from your computer. Any other use, retention, dissemination, forwarding, printing, or copying of this e-mail is strictly prohibited."</span></i><span style="font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""></o:p></span></div></div><div class=""><div style="margin: 0in 0in 0.0001pt 0.5in; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span style="color: rgb(31, 73, 125);" class=""> </span><span style="font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""></o:p></span></div></div><div class=""><div style="margin: 0in 0in 0.0001pt 0.5in; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span style="color: rgb(31, 73, 125);" class=""> </span><span style="font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""></o:p></span></div></div><div class=""><div style="margin: 0in 0in 0.0001pt 0.5in; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""> <span style="font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""></o:p></span></div></div><div style="margin: 0in 0in 0.0001pt 0.5in; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span style="font-size: 9pt; font-family: Helvetica, sans-serif;" class="">_______________________________________________<br class="">Questions mailing list<br class=""></span><a href="mailto:Questions@cabforum.org" style="color: purple; text-decoration: underline;" class=""><span style="font-size: 9pt; font-family: Helvetica, sans-serif;" class="">Questions@cabforum.org</span></a><span style="font-size: 9pt; font-family: Helvetica, sans-serif;" class=""><br class=""></span><a href="https://urldefense.proofpoint.com/v2/url?u=https-3A__cabforum.org_mailman_listinfo_questions&d=BQICAg&c=eEvniauFctOgLOKGJOplqw&r=bPeNvovSv0L4jj3hFD6Tw5sI3rGGNujxDceaEaUPuUQ&m=ZAkCyRUyNPWbkd0s3fkfjeZO8EmFbGVXhmSu5qjGlhc&s=rH3ItIyTa4kLx-3C_jU6P1OrzSZVef-pwDY4yrOZdM4&e=" style="color: purple; text-decoration: underline;" class=""><span style="font-size: 9pt; font-family: Helvetica, sans-serif;" class="">https://urldefense.proofpoint.com/v2/url?u=https-3A__cabforum.org_mailman_listinfo_questions&d=BQICAg&c=eEvniauFctOgLOKGJOplqw&r=bPeNvovSv0L4jj3hFD6Tw5sI3rGGNujxDceaEaUPuUQ&m=ZAkCyRUyNPWbkd0s3fkfjeZO8EmFbGVXhmSu5qjGlhc&s=rH3ItIyTa4kLx-3C_jU6P1OrzSZVef-pwDY4yrOZdM4&e=</span></a><o:p class=""></o:p></div></div></blockquote></div><div style="margin: 0in 0in 0.0001pt 0.5in; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><o:p class=""> </o:p></div><table class="MsoNormalTable" border="0" cellspacing="3" cellpadding="0"><tbody class=""><tr class=""><td style="background-color: white; padding: 0.75pt; background-position: initial initial; background-repeat: initial initial;" class=""><table class="MsoNormalTable" border="0" cellspacing="3" cellpadding="0"><tbody class=""><tr class=""><td style="padding: 0.75pt;" class=""><pre style="margin: 0in 0in 0.0001pt; font-size: 10pt; font-family: 'Courier New';" class=""><o:p class=""> </o:p></pre><pre style="margin: 0in 0in 0.0001pt; font-size: 10pt; font-family: 'Courier New';" class="">TREND MICRO EMAIL NOTICE<o:p class=""></o:p></pre><pre style="margin: 0in 0in 0.0001pt; font-size: 10pt; font-family: 'Courier New';" class="">The information contained in this email and any attachments is confidential <o:p class=""></o:p></pre><pre style="margin: 0in 0in 0.0001pt; font-size: 10pt; font-family: 'Courier New';" class="">and may be subject to copyright or other intellectual property protection. <o:p class=""></o:p></pre><pre style="margin: 0in 0in 0.0001pt; font-size: 10pt; font-family: 'Courier New';" class="">If you are not the intended recipient, you are not authorized to use or <o:p class=""></o:p></pre><pre style="margin: 0in 0in 0.0001pt; font-size: 10pt; font-family: 'Courier New';" class="">disclose this information, and we request that you notify us by reply mail or<o:p class=""></o:p></pre><pre style="margin: 0in 0in 0.0001pt; font-size: 10pt; font-family: 'Courier New';" class="">telephone and delete the original message from your mail system.<o:p class=""></o:p></pre></td></tr></tbody></table></td></tr></tbody></table><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><o:p class=""> </o:p></div></div><span style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; float: none; display: inline !important;" class="">_______________________________________________</span><br style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class=""><span style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; float: none; display: inline !important;" class="">Public mailing list</span><br style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class=""><span style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; float: none; display: inline !important;" class=""><a href="mailto:Public@cabforum.org" class="">Public@cabforum.org</a></span><br style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class=""><span style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; float: none; display: inline !important;" class=""><a href="https://cabforum.org/mailman/listinfo/public" class="">https://cabforum.org/mailman/listinfo/public</a></span></div></blockquote></div><br class=""></div></body></html>