[cabfpub] BR Requirements for 1024-bit Certificates

Brian Trzupek BTrzupek at trustwave.com
Thu Jan 31 22:52:22 UTC 2013


I think we agree with Eddy. We all need to bite the bullet.

Sent from my iPhone

On Jan 31, 2013, at 4:12 PM, "Eddy Nigg (StartCom Ltd.)" <eddy_nigg at startcom.org<mailto:eddy_nigg at startcom.org>> wrote:


On 01/31/2013 11:58 PM, From Wayne Thayer:

I'm not yet aware of any known practical brute force attack on 1024 bit RSA keys.  On the other hand, it is clear that there will be a major impact on existing SSL sites as CAs work to rekey 10's of thousands of certificates this year.  I'd like to propose that we extend the deadline in the BRs for revoking existing certs with 1024 bit keys pending further evidence of a practical vulnerability.  Do others support this change?

No, at least we don't - those that took steps to ensure adequate keys sizes in the past were at a disadvantage when refusing to sign certificate with smaller keys. Today with the BR in place, the same rules are applied throughout the industry and I don't consider it a good idea to roll back on this (and other issues) which we finally nailed down.

Additionally we don't have to wait for the catastrophe to arrive in order to take actions, we really should be at least a half-step ahead.

Finally do I consider a promise to revoke such certificates in December 2013 not compliant to the BR - and probably also not to some of the software vendors requirements if I recall correctly. So your statement is correct, that as of today there shouldn't be any certificates with a validity of a year and more with 1024 bit keys.


Regards

Signer:         Eddy Nigg, COO/CTO
        StartCom Ltd.<http://www.startcom.org>
XMPP:   startcom at startcom.org
Blog:   Join the Revolution!<http://blog.startcom.org>
Twitter:        Follow Me<http://twitter.com/eddy_nigg>


_______________________________________________
Public mailing list
Public at cabforum.org<mailto:Public at cabforum.org>
https://cabforum.org/mailman/listinfo/public

________________________________

This transmission may contain information that is privileged, confidential, and/or exempt from disclosure under applicable law. If you are not the intended recipient, you are hereby notified that any disclosure, copying, distribution, or use of the information contained herein (including any reliance thereon) is STRICTLY PROHIBITED. If you received this transmission in error, please immediately contact the sender and destroy the material in its entirety, whether in electronic or hard copy format.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.cabforum.org/pipermail/public/attachments/20130131/049fb94a/attachment-0003.html>


More information about the Public mailing list