<html><head><meta http-equiv="Content-Type" content="text/html charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><div class="">The fact that we have different groups all waiting on the others to act is precisely the source of my frustration here.</div><div class=""><br class=""></div><div class="">I think Gerv’s suggestion of a motion on intent is the way to get out of the deadlock. We can even specify criteria that would need to be met before adoption was likely to take place. That then provides material that can be cited by CAs issuing RFPs for future HSMs, etc.</div><div class=""><br class=""></div><div class="">This is how government processes work. In the UK/EU there is a green paper that proposes a course of action and then a white paper that specifies more detail which may lead to a bill in parliament enacting the change.</div><div class=""><br class=""></div><div class=""><br class=""></div><div class=""><br class=""></div><br class=""><div><blockquote type="cite" class=""><div class="">On Feb 24, 2017, at 2:14 PM, Ryan Sleevi <<a href="mailto:sleevi@google.com" class="">sleevi@google.com</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><div dir="ltr" class=""><br class=""><div class="gmail_extra"><br class=""><div class="gmail_quote">On Fri, Feb 24, 2017 at 9:58 AM, <a href="mailto:philliph@comodo.com" class="">philliph@comodo.com</a> <span dir="ltr" class=""><<a href="mailto:philliph@comodo.com" target="_blank" class="">philliph@comodo.com</a>></span> wrote:<br class=""><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div style="word-wrap:break-word" class=""><div class=""><span class="gmail-"><div class=""><br class=""></div></span><div class="">Well as it happens, that is not a problem. </div><div class=""><br class=""></div><div class="">* There is a set of FIPS requirements and testing regimes etc. for SHA-3</div><div class="">* There are HSMs that have met those requirements. </div><div class=""><br class=""></div><div class="">What is a concern related to HSMs is that the transition is widely supported so CAs do not have to make major changes to their infrastructure or change suppliers or use different hardware for SHA-3 certificates.</div><div class=""><br class=""></div><div class="">The availability of HSMs is a concern but it is actually the very last but one on the critical path which is at present</div><div class=""><br class=""></div><div class="">* NIST issues FIPS (done)</div><div class="">* IETF publishes specification (started on this)</div><div class="">* CABForum amends guidelines to permit use</div><div class="">* Browsers add support</div><div class="">* HSM vendors ship product</div><div class="">* CAs issue certificates.</div></div></div></blockquote><div class=""><br class=""></div><div class="">As indicated before, I believe you have critically misordered these requirements, which may be the source of our disagreement. I do not expect you to agree, but I hope you can understand why, from my perspective, the order is:</div><div class=""><br class=""></div><div class=""><div class="">* NIST issues FIPS (done)</div><div class="">* IETF publishes specification (started on this)</div><div class=""><div class=""> * HSM vendors ship product</div></div><div class=""> * CABForum amends guidelines to permit use<br class=""></div><div class="">* Browsers add support</div><div class="">* CAs issue certificates.<br class=""></div></div><div class=""><br class=""></div><div class="">That is, I see the HSM discussion happening in parallel to permitting, but I see both as blocking for browsers adding support.</div><div class=""> </div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div style="word-wrap:break-word" class=""><div class=""><span class="gmail-"><div class="">The issue is irrelevant.<br class=""></div></span></div></div></blockquote><div class=""><br class=""></div><div class="">We will disagree, then, and given the remainder of the mail, it's perhaps best that you and I stop talking about this, as we recognize our disagreement.</div><div class=""><br class=""></div></div></div></div>
</div></blockquote></div><br class=""></body></html>