On 04/21/2016 04:51 AM, [email protected] wrote:
Hello,
Two questions: the condition "starting on 2017-01-01" will this be
part of the general algorithm deprecation or the jdkCA qualifier.
I.e. if I add "SHA1" with no qualifier, will it be in effect
immediatelly?
We are going to add a field to the constraint that indicates the start
date of the restrictions, but it is not reflected in the JEP yet. You
will be able to adjust this date, or remove it, in which case the
restrictions would take effect immediately.
The exception for timestamped code, does it also consider the actual
signature hash algorithm? (Asuming SHA1 would be to weak I could also
forge an backdated TS signature).
That's the intention. We are still working through some of the details
on that and doing more testing.
I guess it is implicitely stated but not spelled out: the self
signature on root certificates is not considered part of the path
checking and can be SHA1, right?
Yes. I'll clarify that in the JEP.
Thanks for the comments/questions.
--Sean
