Ubuntu
firefox package

  1. Bug #312536
  2. Comment #12

Comment 12 for bug 312536

Revision history for this message
In , Rrelyea (rrelyea) wrote :

After reading the paper, I realized I misremembered. It was Lentra's 2005 collision paper I was remembering, which evidently used MD5. What the chaos paper did was show a practical example of this attack using real CAs.

SHA-1 is fine for now, though we should continue to push the use of SHA-2 when possible. EV already requires SHA-1 and requires SHA-2 by 2010.

Anyway, it seems this should be a reasonable patch.

bob