My goal is to make a certificate's thumbprint "easier" to verify, and not reduce security in doing so.
Given that the RSA-based Bitcoin technology has a concept called a "Vanity address" where the random keys are regenerated over and over again until the hash has user-defined leading bits (the content and length of bits are arbitrary), and it doesn't reduce security, I think it's possible to apply this concept to a CA and its Thumbprint/Fingerprint and make manual validation easier.
Of course the computational power needed to customise the leading bits of this hash gets longer (exponentially longer??) for each bit we want to customize, does this activity reduce security in any way?
Question
Would this increase security for non-trusted root certificates that need manual verification? What about other certificate types?
Since SHA1 is secure against second preimage attacks, is there any risk in having a CA continually regenerate keys so that the above thumbprint would read
01:23:45:67:89:01:23:45:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx
(variable number of bits set, fewer unique bits to verify)If this is a good idea, how many bits should be set for a root CA with a long expiration, versus a intermediate, vs a user or web server CA with a consecutively shorter expiration? (in year 2013)
What server software would support this customization, or scripting of this regeneration until the criteria is set?
What value is appropriate to make validation easier? Setting to all zeros may make it harder to verify, and since people think in Base10 sequential numbering for humans may be easy
01:02:03:04:05:06:07:08:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx