PKIX implications of SHA-1 collisions

[Russ Housley <housley@xxxxxxxxxxxx>]

I am sure that almost everyone on this list is already aware of the news 
regarding SHA-1.  For those who have not, see 
http://www.schneier.com/blog/archives/2005/02/sha1_broken.html

A 2^69 work factor is bad, but not a complete disaster.  At least not 
yet.  Of course, as Bruce Schneier has noted, attacks never get worse; they 
only improve.

From the information that we have so far, two messages that have 
collisions will have a particular structure.  I propose we have a pretty 
easy way to make sure that we can avoid that structure in X.509 
certificates.  We can construct the certificate serial number, which is 
always part of the first hash block, from a random number in addition to 
any other CA-specific serial number assignment scheme.  For example, the 
serial number might be a counter concatenated with a 64-bit random value.

I think this can documented very quickly in a BCP.  It should just be a few 
pages.  I am willing to help write it.

Russ