Subject: Re: OCSPv2: 02: certHash is not unique

From: [email-masked] (Peter Gutmann)
Date: Thu, 29 Mar 2001 09:47:29 (NZST)

"Carlin Covey" <[email-masked]> writes:

>I am quite content with the suggestion that Jim made concerning computing the
>certHash over only the signed portions of the certificate.  

I'm not.  I already have to create, track, store, and process a whole pile of
certificate identifiers, and adding yet another wierdo identifier which is
compatible with nothing else in existence to that pile when there's no need for
it to be incompatible is something which I can really do without.  The SHA-1
hash of the whole cert as "fingerprint" is pretty much universally used and
accepted, unless there's a very strong reason not to use it I don't see why we
need to invent yet another new identifier.

Peter.

---

From: "Carlin Covey" <[email-masked]>
Date: Wed, 28 Mar 2001 14:58:42 -0700

Peter and Tim,

I'm content with the "fingerprint" too.  I place my faith in the
SHA-1 hash, not whether or not some of the bits fed into the hash
can be manipulated.  Tim, is my faith in SHA-1 misplaced?

Regards,

Carlin

____________________________

-  Carlin Covey
   Cylink Corporation

-----Original Message-----
From: [email-masked] [mailto:[email-masked]]
Sent: Thursday, March 29, 2001 9:47 AM
To: [email-masked]; [email-masked]
Subject: Re: OCSPv2: 02: certHash is not unique

>certHash over only the signed portions of the certificate.

I'm not.  I already have to create, track, store, and process a whole pile
of
certificate identifiers, and adding yet another wierdo identifier which is
compatible with nothing else in existence to that pile when there's no need
for
it to be incompatible is something which I can really do without.  The SHA-1
hash of the whole cert as "fingerprint" is pretty much universally used and
accepted, unless there's a very strong reason not to use it I don't see why
we
need to invent yet another new identifier.

Peter.

---

From: "Michael Myers" <[email-masked]>
Date: Wed, 28 Mar 2001 17:58:30 -0800

Peter,

After some correspondence, I've come to the same conclusion despite my prior
proposal to Jim.  The high-level intent of the presence of an option to
hash/fingerprint the cert was to enable alignment to known practices, not
produce yet another variant.

Mike