Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Gradually sunsetting SHA-1

googleonlinesecurity.blogspot.com

Post reply on HN
Print view View original

71–80 of 100 posts

Re: Gradually sunsetting SHA-1

#71

Post by sandstrom »

scrollaway wrote: post #41
Alupis wrote: post #15

This is about to become a massive issue for Godaddy SSL users[1] seeing that Godaddy has still not added their G2 CA server (which signs all SHA-2 certs at Godaddy) to the default truststore for Java and some other devices/languages/platforms! [1] http://stackoverflow.com/questions/18746565/godaddy-ssl-cert...

Excellent; this should be another reason for some people to no longer be a client of one of the worst companies in the tech sector today. I'll leave CA recommendations to those who deal with them more than I, but if you use Godaddy as a registrar I would urge you to switch to Gandi.net (or namecheap.com if you cannot afford Gandi).

I second this. It's an excellent reason to switch away from GoDaddy!

gandi.net, namecheap.com are both good alternatives.

Re: Gradually sunsetting SHA-1

#72

Post by hstrauss »

eastdakota wrote: post #29

I'm concerned that the net effect of this will be to make the Internet less secure. In most cases, webmasters will be forced to make a Faustian choice: live with the scary warning in Chrome for modern users or give up support of browsers running on Windows XP (pre-SP3) and early versions of Android (pre-2.3), since they don't support certificates with a more secure hash than SHA1. We'll likely write a blog post soon…

For Windows XP and Server 2003, there is a hotfix: http://support.microsoft.com/kb/968730

This enables SHA-2 certificates. Deployment of the patch is another problem, since it's a HotFix (which may have enterprise-QA issues) and not intended for general use, AFAIK. Still, I've been using it since WS2008 originally came out.

Re: Gradually sunsetting SHA-1

#73

Post by nknighthb »

eastdakota wrote: post #29

I'm concerned that the net effect of this will be to make the Internet less secure. In most cases, webmasters will be forced to make a Faustian choice: live with the scary warning in Chrome for modern users or give up support of browsers running on Windows XP (pre-SP3) and early versions of Android (pre-2.3), since they don't support certificates with a more secure hash than SHA1. We'll likely write a blog post soon…

I'm extremely troubled that CloudFlare is taking this short-sighted stance.

The faustian choice will soon be between having no security on any platform and supporting ancient platforms. This could come at any time. It could already be too late.

Like it or not, you are a security company. You should act like it. This is not acting like it.

Re: Gradually sunsetting SHA-1

#74

Post by agl »

eastdakota wrote: post #62
agl wrote: post #42

Earlier quoted context omitted.

Unfortunately we don't have the technical ability, nor do people have the mental capacity, to cope with multiple URL schemes for different "levels" of security. SHA-1 limits the security for everyone and all uses. And if sites are worried about compat, Google will be doing this transition along with everyone else. That's a good tailwind to ride. If Microsoft's 2016/2017 deadline is reckless, what SHA-1 deprecation da…

Google, CloudFlare and a handful of the technically sophisticated organizations have the ability to return different certificates depending on the connecting browser. Your argument would be far more persuasive if Google were really biting the bullet and dropping support for SHA1 even when an old browser connects. I assume that's not what you're doing, but please correct me if I'm wrong. If you are returning two diffe…

> Your argument would be far more persuasive if Google were really biting the bullet and dropping support for SHA1 even when an old browser connects.

That's certainly the plan. What did I say that suggests otherwise?

Re: Gradually sunsetting SHA-1

#75

Post by Gregordinary »

ivanr wrote: post #9

By the way, this blog post does not mention that Microsoft already effectively killed SHA1 last year when it announced that it wouldn't accept SHA1 certificates after 2016: http://blogs.technet.com/b/pki/archive/2013/11/12/sha1-depre...

They've actually split the deadlines for SSL Certificates and Code Signing client certificates.

The deadline for websites to upgrade their SSL Certificates is January 2017.

In January 2016, Microsoft will stop trusting code signed with a SHA1 certificate, unless it was timestamped prior to that date. In that case it will continue to be trusted until SHA1 is found be vulnerable to pre-image attack.

Re: Gradually sunsetting SHA-1

#76

Post by Gregordinary »

hstrauss wrote: post #72
eastdakota wrote: post #29

I'm concerned that the net effect of this will be to make the Internet less secure. In most cases, webmasters will be forced to make a Faustian choice: live with the scary warning in Chrome for modern users or give up support of browsers running on Windows XP (pre-SP3) and early versions of Android (pre-2.3), since they don't support certificates with a more secure hash than SHA1. We'll likely write a blog post soon…

For Windows XP and Server 2003, there is a hotfix: http://support.microsoft.com/kb/968730 This enables SHA-2 certificates. Deployment of the patch is another problem, since it's a HotFix (which may have enterprise-QA issues) and not intended for general use, AFAIK. Still, I've been using it since WS2008 originally came out.

The hotfix KB 968730 for Server 2003 includes updates from hotfix KB 938397. An important thing to note from KB 938397 is that "KB 938397 will bring Windows Server 2003 to the same level of functionality as Windows XP with Service Pack 3." [1]

What that translates to is that it only gives Server 2003 SHA2 support as a client, not as a server. I.e. You can connect to sites that are using SHA2 certs, but you cannot bind a SHA2 cert to your own website in IIS 6/Server 2003.

So once SHA1 is completely deprecated, those hosting sites or legacy apps on Windows Server 2003 will not be able to upgrade to SHA2 certs.

[1] http://blogs.technet.com/b/pki/archive/2010/09/30/sha2-and-w...

Re: Gradually sunsetting SHA-1

#77

Post by robertduncan »

scrollaway wrote: post #41
Alupis wrote: post #15

This is about to become a massive issue for Godaddy SSL users[1] seeing that Godaddy has still not added their G2 CA server (which signs all SHA-2 certs at Godaddy) to the default truststore for Java and some other devices/languages/platforms! [1] http://stackoverflow.com/questions/18746565/godaddy-ssl-cert...

Excellent; this should be another reason for some people to no longer be a client of one of the worst companies in the tech sector today. I'll leave CA recommendations to those who deal with them more than I, but if you use Godaddy as a registrar I would urge you to switch to Gandi.net (or namecheap.com if you cannot afford Gandi).

Note that Gandi do not offer SHA-2 certificates at all at the moment.

https://twitter.com/gandibar/status/508001036653826049

Re: Gradually sunsetting SHA-1

#78

Post by Gregordinary »

agl wrote: post #37
rdl wrote: post #32

I'm glad to see people move off old browsers, in general. SHA1 is far from the biggest problem with Windows XP SP2; in fact, I'd probably say SHA1 is one of the most secure aspects of the OS. The actual weaknesses in SHA1 which have been identified are very serious, but still requiring on the order of 2^61 operations to cause a collision, and there is a fairly indirect path between hash collision and end of the world…

This was already announced by Microsoft last year: https://technet.microsoft.com/en-us/library/security/2880823... Unfortunately, many CAs decided to ignore it, presumably on the assumption that Microsoft would be forced to back down. We've done this dance with MD5 and 1024-bit certificates and we know how it goes. Here's a quick list of CAs that issued more than 2000 certificates extending into 2017 with SHA-1: Glob…

I suppose the CA's didn't jump on issuing SHA2 certs the same day as the as the Baseline update or the MS announcement, but they don't seem to be standing still.

GlobalSign, the first one on your list for example, has limited the validity on new SHA1 certs to 3 years and will reduce that to 2 years and 1 year as the MS deadline approaches. https://blog.globalsignblog.com/blog/everything-you-need-to-...

Don't know if GoDaddy has limited the validity periods, but they do list the deadlines and suggest re-keying your cert: https://support.godaddy.com/help/article/4818/information-ab...

Wondering how many of those certs from GlobalSign, GoDaddy, GeoTrust, etc. are 4 & 5 year certs purchased prior to any announcement? As you noted CA's like to push multi-year certs.

While you can usually reissue/re-key your cert free of charge with CA's, a lot of companies are probably hesitant to make sudden moves to SHA2 when there are compatibility concerns. Many on legacy systems like Server 2003 cannot update to SHA2. As I mentioned in another comment the hotfixes only bring Server 2003 SHA2 support up to the same level as XP SP3. (Only compatible as a client, not as a server).

Also Microsoft's fastest approaching SHA2 deadline is January 2016 for CodeSigning yet Windows Vista & 7 don't support SHA2 signatures on kernel drivers. Not sure if that's been patched yet, but it would seem Microsoft isn't fully prepared to support their own policies either at the time of their own announcement.

Re: Gradually sunsetting SHA-1

#79

Post by gergles »

iancarroll wrote: post #68
gergles wrote: post #20

Earlier quoted context omitted.

Digicert, the CA that signs their cert, is all SHA1, so they'll probably need to change CAs at a minimum.

Digicert offers SHA2 certificates. It's the default option IIRC. This only applies to end entity certificates, mind you.

It doesn't, it applies to the entire cert chain (minus the root). DigiCert's non-EV intermediate cert (DigiCert Secure Server CA) is SHA1, so until they fix that, all DigiCert users are still going to be affected.

Re: Gradually sunsetting SHA-1

#80

Post by tptacek »

jimmyfalcon wrote: post #6

This leads to me to think about the longer term viability of bitcoin. Bitcoin uses a combination of RIPEMD and SHA256. Given the sha-2 family was released in 2001, when is SHA-2 going to go into depreciation cycle and what does that mean for the bitcoin network. Given that there are plenty of op-codes left, the network can probably easily start switching into in the next generation of hashing algorithms. This is the…

You can't look at SHA-1, SHA-2, and SHA-3 as successive "versions" of hash functions. They're distinct things. SHA-3 isn't so much "better" than SHA-2 as it is "different". It has some practical improvements, but those improvements aren't relevant to the certificate use case.

So far as we know, there is no timeline for the deprecation of SHA-2. In fact, most people are better off right now using SHA-2 than SHA-3.

Post reply on HN