[cabfpub] Intent to Deprecate: SHA-1 certificates

[kirk_hall at trendmicro.com]

Chris – a serious question.  Is it true that  google.com<http://google.com/> is still using SHA-1 in both end-entity and intermediate certificates today (as has been posted to this site)?  If so, how can Google be so condemning of ordinary websites that are also using SHA-1 certs today, even though there has been discussion of SHA-1’s potential weakness, as you say, for several years?

So many of the postings on this topics have shown a strong antipathy toward CAs – toward ALL CAs, without making any distinctions.  Google is painting everyone with the same brush.  How can we turn this around, and create a more collaborative environment among browsers, browser users, CAs, website owners?

Google’s current policy will be creating a kind of chaos for many website owners in the next few weeks who have no idea why this is happening.  It will be affecting websites that have already started transition plans to SHA-256 certs before 2017.  Isn’t there a better way?

From: security-dev at chromium.org [mailto:security-dev at chromium.org]
Sent: Thursday, August 28, 2014 9:54 PM
To: Jeremy Rowley
Cc: blink-dev; security-dev; rsleevi; net-dev
Subject: Re: Intent to Deprecate: SHA-1 certificates


> Only if one ignores fairly clear statements from 6 months ago. Keep in mind that it's already 12 *years* after we've known from public literature that SHA-1 is significantly weaker than its designed guarantee.

Oops, 9 years now; 12 years in 2017. Sorry about that.
To unsubscribe from this group and stop receiving emails from it, send an email to security-dev+unsubscribe at chromium.org<mailto:security-dev+unsubscribe at chromium.org>.

<table class="TM_EMAIL_NOTICE"><tr><td><pre>
TREND MICRO EMAIL NOTICE
The information contained in this email and any attachments is confidential 
and may be subject to copyright or other intellectual property protection. 
If you are not the intended recipient, you are not authorized to use or 
disclose this information, and we request that you notify us by reply mail or
telephone and delete the original message from your mail system.
</pre></td></tr></table>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: https://cabforum.org/pipermail/public/attachments/20140829/4b1ac833/attachment.html