Re: [saag] SHA-1 to SHA-n transition

[Bill Sommerfeld <[e-mail]>]

On Thu, 2009-02-26 at 09:38 -0500, Theodore Tso wrote:

> There are couple of things we need to do in order to successfully
> carry off a migration:
> 
> (1) ...
> (2) ...
> (3) Once (1) and (2) are done, <deploy certs using sha-n>

So, that sort of transition plan is doomed.  (1) and (2) will never be
"done" because there will always be sites and clients running old
software.

What's more, software which has not been tested does not work.  We don't
know until we start trying to deploy sha-n certs on a wide scale if we
got all the details right, and if we got something wrong and have to
tweak the browsers again...

IMHO we need a transition plan which allows websites to deploy with
sha-n certs in parallel to sha-1 certs from day 1 (and, if I dare
mention it, we need to find some way to do this without making them pay
a bunch of nuisance fees to CA operators).

That way the hard part of the transition plan looks more like:

 n) release software which expects sha-n and considers sha-1 an
exceptional case.

and the triggering event for this can be somewhat more flexible.  It may
still happen shortly after a "cnn moment", but which would be a much
more graceful transition than if we had to throw the switch starting
today.