IETF Logo Mail Archive

Re: [saag] SHA-1 to SHA-n transition

"Hallam-Baker, Phillip" <pbaker@verisign.com> Thu, 26 February 2009 01:34 UTC

Return-Path: <pbaker@verisign.com>
X-Original-To: saag@core3.amsl.com
Delivered-To: saag@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id DA40B3A6A9C for <saag@core3.amsl.com>; Wed, 25 Feb 2009 17:34:45 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -5.508
X-Spam-Level:
X-Spam-Status: No, score=-5.508 tagged_above=-999 required=5 tests=[AWL=-0.306, BAYES_00=-2.599, HTML_MESSAGE=0.001, MIME_QP_LONG_LINE=1.396, RCVD_IN_DNSWL_MED=-4]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id U86Ub0D+bFR6 for <saag@core3.amsl.com>; Wed, 25 Feb 2009 17:34:44 -0800 (PST)
Received: from colibri.verisign.com (colibri.verisign.com [65.205.251.74]) by core3.amsl.com (Postfix) with ESMTP id E043A3A69C3 for <saag@ietf.org>; Wed, 25 Feb 2009 17:34:44 -0800 (PST)
Received: from MOU1WNEXCN03.vcorp.ad.vrsn.com (mailer6.verisign.com [65.205.251.33]) by colibri.verisign.com (8.13.6/8.13.4) with ESMTP id n1Q1AiDu026753; Wed, 25 Feb 2009 17:10:44 -0800
Received: from MOU1WNEXMB09.vcorp.ad.vrsn.com ([10.25.15.197]) by MOU1WNEXCN03.vcorp.ad.vrsn.com with Microsoft SMTPSVC(6.0.3790.3959); Wed, 25 Feb 2009 17:35:06 -0800
X-MimeOLE: Produced By Microsoft Exchange V6.5
Content-class: urn:content-classes:message
MIME-Version: 1.0
Content-Type: multipart/alternative; boundary="----_=_NextPart_001_01C997B2.732D57BE"
Date: Wed, 25 Feb 2009 17:35:04 -0800
Message-ID: <2788466ED3E31C418E9ACC5C3166155768B2CE@mou1wnexmb09.vcorp.ad.vrsn.com>
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
Thread-Topic: [saag] SHA-1 to SHA-n transition
Thread-Index: AcmXg1Y7xVXyrzTlS+6/sU1/NXLwuQAD5SArAAMRyZAABDIfaA==
References: <p06240802c5c5c22d92f0@[128.89.89.88]><200902231914.n1NJEDA3011916@raisinbran.srv.cs.cmu.edu><5A6509457B6F0F71878AA5D2@atlantis.pc.cs.cmu.edu><2788466ED3E31C418E9ACC5C3166155768B2C7@mou1wnexmb09.vcorp.ad.vrsn.com><200902251951.OAA23103@Sparkle.Rodents-Montreal.ORG> <2788466ED3E31C418E9ACC5C3166155768B2CB@mou1wnexmb09.vcorp.ad.vrsn.com> <0c2301c9979f$8a1cd770$0600a8c0@china.huawei.com>
From: "Hallam-Baker, Phillip" <pbaker@verisign.com>
To: David Harrington <ietfdbh@comcast.net>, der Mouse <mouse@Rodents-Montreal.ORG>, saag@ietf.org
X-OriginalArrivalTime: 26 Feb 2009 01:35:06.0249 (UTC) FILETIME=[73F9BF90:01C997B2]
Subject: Re: [saag] SHA-1 to SHA-n transition
X-BeenThere: saag@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Security Area Advisory Group <saag.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/saag>, <mailto:saag-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/saag>
List-Post: <mailto:saag@ietf.org>
List-Help: <mailto:saag-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/saag>, <mailto:saag-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 26 Feb 2009 01:34:45 -0000

I was intending to raise a serious technical point. If the comment might have been interpreted as offensive it is because it might be interpeted as a suggestion that people would be more interested in debating a distraction than the technical issue. 
 
 
Can we please stop the agenda denial tactics and talk about the fact that we may have a serious problem?
 
Currently the industry is taking for granted the idea that merely distributng browsers that support stronger crypto algorithms is sufficient to support a transition when that becomes necessary. But when serious attention is paid to the business issues that drive the purchase of certificates it is clear that this strategy is not going to result in the withdrawal of support for SHA1 certificates until the population of browsers that support only SHA1 is negligible. That will take at least a decade, possibly much longer.
 
If people really think that Amazon.com is going to say 'I know that only 95% of browsers support SHA1, but I am going to get an SHA2 cert and lose that 5% of sales so that our transactions are as secure as possible' because someone finds a practical attack on SHA1, then let them say that. So far nobody has challenged the analysis directly, they have merely described themselves as unconvinced that there is a problem.
 
 
 

________________________________

From: David Harrington [mailto:ietfdbh@comcast.net]
Sent: Wed 2/25/2009 6:19 PM
To: Hallam-Baker, Phillip; 'der Mouse'; saag@ietf.org
Subject: RE: [saag] SHA-1 to SHA-n transition


Hi,
 
I find it rich that you started this thread by being offensive, and now you want
"

	Let us stick to the technical issues here:
	 
	If you want people to listen to you and discuss technical arguments, maybe you should learn to introduce the topics in a less offensive manner.
	 
	If people do not want to have this discussion with you at this time, you have only yourself to blame.
	 
	David Harrington
	dbharrington@comcast.net
	ietfdbh@comcast.net
	dharrington@huawei.com

v2.23.0 | Report a Bug | By Email