<html><head><meta http-equiv="Content-Type" content="text/html charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;">That does not follow.<div><br></div><div>If all it took to effect a transition was to vote, everything would be a lot simpler. The question is still whether the insecurity due to a delay is greater or less than the insecurity due to attempting a transition before everyone is ready.</div><div><br></div><div><br></div><div><br></div><div><br></div><div><br><div><div>On Oct 10, 2015, at 11:06 PM, Richard Wang <<a href="mailto:richard@wosign.com">richard@wosign.com</a>> wrote:</div><br class="Apple-interchange-newline"><blockquote type="cite"><div lang="ZH-CN" link="blue" vlink="purple" style="font-family: Helvetica; font-size: 18px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;"><div class="WordSection1" style="page: WordSection1;"><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 宋体;"><a name="_MailEndCompose"><span lang="EN-US" style="font-family: Calibri, sans-serif; color: rgb(31, 73, 125);">The final sentence is the important one – “Vote NO”:<o:p></o:p></span></a></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 宋体;"><span lang="EN-US" style="font-family: Calibri, sans-serif; color: rgb(31, 73, 125);"> </span></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 宋体;"><span lang="EN-US" style="font-size: 10.5pt; font-family: Arial, sans-serif;">The paper was written by Marc Stevens, Pierre Karpman, and Thomas Peyrin. The new calculations, should they be confirmed by the researchers' peers, are likely to provide a strong argument for<span class="Apple-converted-space"> </span><b><span style="color: red;">voting no</span></b><span class="Apple-converted-space"> </span>and instead quickly migrating to use of SHA2, which is much more resistant to collisions.</span><span lang="EN-US" style="font-family: Calibri, sans-serif; color: rgb(31, 73, 125);"><o:p></o:p></span></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 宋体;"><span lang="EN-US" style="font-family: Calibri, sans-serif; color: rgb(31, 73, 125);"> </span></div><div><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 宋体; text-align: justify;"><span lang="EN-US" style="font-family: Calibri, sans-serif; color: rgb(31, 73, 125);"> </span></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 宋体; text-align: justify;"><span lang="EN-US" style="font-family: Calibri, sans-serif; color: rgb(31, 73, 125);">Regards,<o:p></o:p></span></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 宋体; text-align: justify;"><span lang="EN-US" style="font-family: Calibri, sans-serif; color: rgb(31, 73, 125);"> </span></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 宋体; text-align: justify;"><span lang="EN-US" style="font-family: Calibri, sans-serif; color: rgb(31, 73, 125);">Richard<o:p></o:p></span></div></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 宋体;"><span lang="EN-US" style="font-family: Calibri, sans-serif; color: rgb(31, 73, 125);"> </span></div><div><div style="border-style: solid none none; border-top-color: rgb(225, 225, 225); border-top-width: 1pt; padding: 3pt 0cm 0cm;"><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 宋体;"><b><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif;">From:</span></b><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif;"><span class="Apple-converted-space"> </span><a href="mailto:public-bounces@cabforum.org">public-bounces@cabforum.org</a> [<a href="mailto:public-bounces@cabforum.org">mailto:public-bounces@cabforum.org</a>]<span class="Apple-converted-space"> </span><b>On Behalf Of<span class="Apple-converted-space"> </span></b>Phillip Hallam-Baker<br><b>Sent:</b><span class="Apple-converted-space"> </span>Sunday, October 11, 2015 9:10 AM<br><b>To:</b><span class="Apple-converted-space"> </span>CABFPub <<a href="mailto:public@cabforum.org">public@cabforum.org</a>><br><b>Subject:</b><span class="Apple-converted-space"> </span>[cabfpub] SHA-1 identical prefix collisions<o:p></o:p></span></div></div></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 宋体;"><span lang="EN-US"> </span></div><div><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 宋体;"><span lang="EN-US">Just a heads up that this is about to hit the wires and it is a public holiday on Monday in many parts of the US.<o:p></o:p></span></div></div><div><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 宋体;"><span lang="EN-US"> </span></div></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 宋体;"><span lang="EN-US"><a href="http://arstechnica.com/security/2015/10/sha1-crypto-algorithm-securing-internet-could-break-by-years-end/" style="color: purple; text-decoration: underline;">http://arstechnica.com/security/2015/10/sha1-crypto-algorithm-securing-internet-could-break-by-years-end/</a><o:p></o:p></span></div><div><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 宋体;"><span lang="EN-US"> </span></div></div><div><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 宋体;"><span lang="EN-US">It really shouldn’t be cause for anyone to be alarmed. These attacks do not allow someone to forge a certificate or break TLS. Any CA that is following the guidelines on incorporating randomness will not be vulnerable even if the more powerful collision attacks are achieved.<o:p></o:p></span></div></div><div><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 宋体;"><span lang="EN-US"> </span></div></div><div><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 宋体;"><span lang="EN-US">This was anticipated and the phase out process is already in place.</span></div></div></div></div></blockquote></div><br></div></body></html>