Subject: [pkix] SHA2 Browser Migration

From: Rick Sanders <[email-masked]>
Date: Mon, 13 Apr 2015 15:40:04 +0000

Hi,

I am an Enterprise Security Architect at GM working on cryptographic management. Lately, the browser community's push to SHA2 has quite a few people worried at my company.

A move to SHA2 will require a significant amount of change in our production environments. Not to mention the ubiquitous communications between heterogeneous platforms and protocol versions. We're unclear of the impacts to our backend infrastructure.

Do you have any folks who are knowledgeable in this space? How could we engage to learn more from them?

-Rick Sanders

Nothing in this message is intended to constitute an electronic signature unless a specific statement to the contrary is included in this message.

Confidentiality Note: This message is intended only for the person or entity to which it is addressed. It may contain confidential and/or privileged material. Any review, transmission, dissemination or other use, or taking of any action in reliance upon this message by persons or entities other than the intended recipient is prohibited and may be unlawful. If you received this message in error, please contact the sender and delete it from your computer.

---

From: Gervase Markham <[email-masked]>
Date: Tue, 14 Apr 2015 15:57:45 +0100

Hi Rick,

> engage to learn more from them?

The Mozilla discussion forum here:
https://www.mozilla.org/en-GB/about/forums/#dev-security-policy
is a good place to ask about Mozilla's attitude to such things. We'd be
interested to hear about what products/devices you have which have
problems with SHA-2 and how that affects general-purpose web browsers.

Although it's not cryptographically recommended, you can keep using
SHA-1 certs by chaining up to roots which are not embedded in current
web browsers. The 1024-bit roots we've been busy removing from the
Mozilla root store may be possible choices here, depending on your
situation and the range of the embedded root stores in your devices.

Gerv