<html><head><meta http-equiv="Content-Type" content="text/html charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><div class=""><br class=""></div><div><blockquote type="cite" class=""><div class="">On Feb 23, 2017, at 11:59 PM, Ryan Sleevi <<a href="mailto:sleevi@google.com" class="">sleevi@google.com</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><div dir="ltr" class=""><br class=""><div class="gmail_extra"><br class=""><div class="gmail_quote">On Thu, Feb 23, 2017 at 8:52 PM, Peter Bowen <span dir="ltr" class=""><<a href="mailto:pzb@amzn.com" target="_blank" class="">pzb@amzn.com</a>></span> wrote:<br class=""><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div style="word-wrap:break-word" class=""><div class=""><span style="font-family:Arial,sans-serif;font-size:13.3333px" class="">All that is preventing the use of </span><span style="font-family:arial,helvetica,san-serif" class="">id-rsassa-pkcs1-v1_5-with-<wbr class="">sha3-256, </span><span style="font-family:arial,helvetica,san-serif" class="">id-rsassa-pkcs1-v1_5-with-<wbr class="">sha3-384, and </span><font face="arial, helvetica, san-serif" size="2" class="">id-rsassa-pkcs1-v1_5-with-<wbr class="">sha3-512 is (1) the BRs and (2) lack of implantation by browsers. When is Chrome planning to support these algorithms?</font></div></div></blockquote><div class=""><br class=""></div><div class="">As there has not been any bug request filed from any member at present, it hasn't been added to any roadmaps that I can share. </div></div></div></div>
</div></blockquote><br class=""></div><div>There is a field of study in political science called agenda denial.</div><div><br class=""></div><div><div class="">That is what people do when they don’t want to actually deal with a particular argument where they know they are at a disadvantage.</div><div class=""><br class=""></div><div class="">Instead of actually engaging on the issue, they challenge the right to raise it. It is always too soon or too late or it has not been raised in the right form. The people trying to raise it did not check the correct box on the right form at the right time. In one venue it is necessary to wait for the other to act, in the other venue the situation is reversed. Or they raised the question in the wrong way.</div><div class=""><br class=""></div><div class="">In every case the tactic is to attack the person making the proposal and their right to raise it rather than deal with the issue on the merits.</div><div class=""><br class=""></div><div class=""><br class=""></div><div class="">The WebPKI has always had two de-facto standard digest algorithms. With the final break of SHA-1 and the publication of SHA-3, there is an urgent need and the ability to specify a new algorithm.</div><div class=""><br class=""></div><div class="">I am raising the SHA-3 issue right now.</div><div class=""><br class=""></div><div class=""><br class=""></div><div class="">To address the points you raised:</div><div class=""><br class=""></div><div class="">* Since CABForum has taken on the role of approving algorithms for the WebPKI, the place to begin a process of rolling out a backup algorithm is here. The IETF frequently receives requests from similar bodies to provide technical support for such proposals and they are almost invariably accepted. I have contacted the Security ADs for advice.</div><div class=""><br class=""></div><div class="">* The lack of HSM support is not a concern as HSM manufacturers respond to the decisions of bodies like CABForum.</div></div><br class=""></body></html>