JEP 288: Disable SHA-1 Certificates
sean.mullan at oracle.com
Thu Apr 21 20:48:06 UTC 2016
On 04/21/2016 04:51 AM, ecki at zusammenkunft.net wrote:
> Two questions: the condition "starting on 2017-01-01" will this be
> part of the general algorithm deprecation or the jdkCA qualifier.
> I.e. if I add "SHA1" with no qualifier, will it be in effect
We are going to add a field to the constraint that indicates the start
date of the restrictions, but it is not reflected in the JEP yet. You
will be able to adjust this date, or remove it, in which case the
restrictions would take effect immediately.
> The exception for timestamped code, does it also consider the actual
> signature hash algorithm? (Asuming SHA1 would be to weak I could also
> forge an backdated TS signature).
That's the intention. We are still working through some of the details
on that and doing more testing.
> I guess it is implicitely stated but not spelled out: the self
> signature on root certificates is not considered part of the path
> checking and can be SHA1, right?
Yes. I'll clarify that in the JEP.
Thanks for the comments/questions.
More information about the security-dev