At 9:38 AM -0500 1/29/07, ROGER YOUNGLOVE wrote:
i believe that SHA1 is not sufficent for a 20 year root CA lifespan.
It would be useful to know where that belief comes from. To date, there have been no suggestions of any weakness for SHA-1 against preimage attacks. Also to date, no one has suggested that it is possible for anyone to brute-force a cryptographic primitive that would require 2^160 iterations.
--Paul Hoffman, Director --VPN Consortium