[cabfpub] SHA1 options for payment processors

[Doug Beattie]

On Thu, Apr 7, 2016 at 11:34 AM, Peter Bowen <pzb at amzn.com<mailto:pzb at amzn.com>> wrote:
Doug,

Would you be able to use the same subject public key and same subject distinguished name as their previous certificate?
[Doug] Yes, We can do this.

Would you be able to use the same certificate profile as your previously issued SHA-1 certificates?

[Doug] Not really, this cert was issued from a different CA, so:
- The CDP, AIA, AKI and Certificate Policies content will be different (the extensions will be there, but content is different)
- Currently, the EKU contains SGC, which we would not use, so that would be removed and just have server auth and client auth
- Key usage, Basic Constraints, SKI and SAN extensions will remain the same
- We would add the SKI extension, consistently with our OV certificate profiles

But, all of the extensions that will be different (CDP, AIA, EKU, Cert Policies) will contain exactly the same values as all other OV certificates issued under this CA

Obviously the IssuerDN, Cert NotBefore/NotAfter and Serial number will be different.


If both are true, then I think that the hash collision risk is heavily mitigated.

Agreed. Or, perhaps stated differently, if whatever changes is consistent for all such certificates (and, even more strongly, consistent with non-SHA1 certificates excluding the signature algorithm), the risk of a CA colluding seems mitigated.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.cabforum.org/pipermail/public/attachments/20160407/870fc412/attachment-0003.html>