<html><head><meta http-equiv="Content-Type" content="text/html charset=us-ascii"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><br class=""><div><blockquote type="cite" class=""><div class="">On Feb 23, 2017, at 10:40 PM, Ryan Sleevi <<a href="mailto:sleevi@google.com" class="">sleevi@google.com</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><div dir="ltr" class=""><br class=""><div class="gmail_extra"><br class=""><div class="gmail_quote">On Thu, Feb 23, 2017 at 7:04 PM, <a href="mailto:philliph@comodo.com" class="">philliph@comodo.com</a> <span dir="ltr" class=""><<a href="mailto:philliph@comodo.com" target="_blank" class="">philliph@comodo.com</a>></span> wrote:<br class=""><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div style="word-wrap:break-word" class=""><div class="">If we are to lead, how about doing the obvious and setting a date by which servers and browsers are advised to provide support for SHA-3?</div></div></blockquote><div class=""><br class=""></div><div class="">Hi Phillip,</div><div class=""><br class=""></div><div class="">Could you point me to any IETF documents that describe or specify how CAs would generate such signatures?</div><div class=""><br class=""></div><div class="">And can you point me to any HSM vendors that CAs might use to ensure that their private keys are appropriately protected when generating these signatures?</div><div class=""><br class=""></div><div class="">I look forward to engaging with you on how we can move the industry forward, and I look forward to opportunities to learn about what efforts Comodo has put forward in this space, as well as opportunities for how we as a Forum can work together to address the necessary and obvious concerns before discussing dates.</div></div></div></div>
</div></blockquote><br class=""></div><div>I did try to get SHA-3 added to the CURDLE working group work items. And I was told that nobody was asking for it. </div><div><br class=""></div><div>Things have to break before some people will act. Which is why I consider the proposal to further reduce validity intervals to provide more procrastination time positively harmful. The SHA-2 transition took a decade. We could have started five years earlier.</div><div><br class=""></div><div>SHA-2 is a direct swap for SHA-3 however. All that is required is to define the necessary OIDs. And the CURDLE charter does not preclude SHA-3, it merely does not list them as current work items.</div><div><br class=""></div><div>If we are going to judge proposals by the number of other industry players who support them, where does a proposal that only garners support of one other browser and one CA stand? </div><br class=""></body></html>