Subject: Re: [Uta] Remarks on bcp-tls-sheffer-01

From: Peter Saint-Andre <[email-masked]>
Date: Mon, 03 Feb 2014 09:58:42 -0700

On 1/1/14, 4:45 PM, Alyssa Rowan wrote:

> • Certificates MUST use at least SHA-1 (and MUST NOT use MD2 or MD5).
> • Certificates SHOULD use SHA-256 - this is preferable, if your clients
>    support this.
>    - Insert notes on which ones do and don't? Is this still a problem?
>    - If not, make SHA-256 a MUST.

A small note about some non-HTTP software: in late 2012 I obtained a 
certificate for the jabber.org IM service with a SHA-256 fingerprint. As 
a result, many IM clients and peer servers were unable to connect, and I 
decided it was necessary to revoke that certificate and instead obtain a 
certificate with a SHA-1 fingerprint.

I'm not sure what the state of play is in the browser world.

Peter

-- 
Peter Saint-Andre
https://stpeter.im/

---

From: Ralph Holz <[email-masked]>
Date: Mon, 03 Feb 2014 18:06:47 +0100

Hi,

> I'm not sure what the state of play is in the browser world.

My take on this is that the BCP is forward-looking, with that term being
defined as "these should be established practices about six months after
publication". I do not know about IM clients, but Microsoft has
announced they want to drop support for SHA1, which will definitely
encourage adoption of other algorithms. As I understand it, Firefox and
Chrome are not lagging behind, either.

Ralph

-- 
Ralph Holz
I8 - Network Architectures and Services
Technische Universität München
http://www.net.in.tum.de/de/mitarbeiter/holz/
Phone +49.89.289.18043
PGP: A805 D19C E23E 6BBB E0C4  86DC 520E 0C83 69B0 03EF

---

From: Peter Saint-Andre <[email-masked]>
Date: Mon, 03 Feb 2014 10:12:01 -0700

On 2/3/14, 10:06 AM, Ralph Holz wrote:
> publication".

That seems right. Although the "c" stands for current, the "b" stands 
for "best". :-)

Peter

-- 
Peter Saint-Andre
https://stpeter.im/