On Tue, Feb 23, 2016 at 9:38 PM, Peter Gutmann <pgut...@cs.auckland.ac.nz> wrote:
> Gervase Markham <g...@mozilla.org> writes: > > >Mozilla is very keen to see SHA-1 eliminated, but understands that for > >historical reasons poor decisions were made in private PKIs about which > roots > >to trust, and such decisions are not easily remedied. > > I'm curious about what's going on here, as you say this is a private PKI, > so > why do they need certs from a public CA? Presumably Worldpay is doing this > for B2B comms, so why don't they issue their own certs, and they can keep > using SHA-1 for as long as required? It seems like Worldpay's mistake > wasn't > failing to update SHA-1 only devices, it was using a public CA for a > private > PKI. > Peter's note reminded me that WorldPay doesn't necessarily have to update the *code* on each of its terminals (to support SHA-2) -- they could also just update the contents of the root store to include one of the roots Symantec operates that is capable of issuing SHA-1 certificates. It doesn't even have to be a root that was ever publicly trusted. I'm not trying to trivialize the difficulty of doing even that -- just noting that, since this is an emergency interim request, WorldPay has simpler emergency interim options than adding SHA-256 support. -- Eric > > Peter. > _______________________________________________ > dev-security-policy mailing list > dev-security-policy@lists.mozilla.org > https://lists.mozilla.org/listinfo/dev-security-policy > -- konklone.com | @konklone <https://twitter.com/konklone> _______________________________________________ dev-security-policy mailing list dev-security-policy@lists.mozilla.org https://lists.mozilla.org/listinfo/dev-security-policy
