Subject: Re: [saag] sha1 - have we more work to do?

From: Rick Andrews <[email-masked]>
Date: Thu, 15 Oct 2015 10:33:23 -0700

Stephen, OCSP (RFC 6960) mandates SHA-1 for KeyHash, though the risk of
using it here is probably very low.

---------------

Message: 2
Date: Fri, 9 Oct 2015 14:25:40 +0100
From: Stephen Farrell <[email-masked]>
To: "[email-masked]" <[email-masked]>
Subject: [saag] sha1 - have we more work to do?
Message-ID: <[email-masked]>
Content-Type: text/plain; charset=utf-8

Hiya,

While it may be still under submission, and not yet peer reviewed, I was
just looking at [1,2] and wondered if we've still work to do to deprecate
sha1 anywhere that we've not yet done. I know a lot of this was done already
but just wanted to check that we're good.

Anyone know places where sha1 is still a should or must or where it's still
in widespread use despite no longer being a should or must?
(No need to mention root stores in browser for that last though, as that's a
known issue and is I think already being tackled by browser
makers.)

I guess we can make a list and then figure out what to do if the list is
non-empty.

Cheers,
S.

[1] https://sites.google.com/site/itstheshappening/
[2] https://sites.google.com/site/itstheshappening/shappening_article.pdf

------------------------------