Re: [saag] sha1 - have we more work to do?

[Sandra Murphy <[e-mail]>]

Probably not what you meant, but…

We had a long discussion in sidr of the potential for collisions from the use of SHA1 to construct key identifiers.  That use is pretty pervasive, since it comes from rfc5280.

—Sandy


On Oct 9, 2015, at 10:25 PM, Stephen Farrell <[e-mail]> wrote:

> 
> Hiya,
> 
> While it may be still under submission, and not yet peer reviewed,
> I was just looking at [1,2] and wondered if we've still work to do
> to deprecate sha1 anywhere that we've not yet done. I know a lot
> of this was done already but just wanted to check that we're good.
> 
> Anyone know places where sha1 is still a should or must or where it's
> still in widespread use despite no longer being a should or must?
> (No need to mention root stores in browser for that last though, as
> that's a known issue and is I think already being tackled by browser
> makers.)
> 
> I guess we can make a list and then figure out what to do if the
> list is non-empty.
> 
> Cheers,
> S.
> 
> [1] https://sites.google.com/site/itstheshappening/
> [2] https://sites.google.com/site/itstheshappening/shappening_article.pdf
> 
> _______________________________________________
> saag mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/saag