Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Gradually sunsetting SHA-1

googleonlinesecurity.blogspot.com

Post reply on HN
Print view View original

91–100 of 100 posts

Re: Gradually sunsetting SHA-1

#91

Post by AlyssaRowan »

agwa wrote: post #84
AlyssaRowan wrote: post #70

Earlier quoted context omitted.

All XP users (including the zillions of pirated ones) can and should upgrade to SP3, free. That leaves aside the question of whether they should still be on the internet, sitting and waiting for the exploit which enables the next "Sapphire". That is going to be a fun day. I'll bring marshmallows. The situation with Android, vendors, old versions, device abandonment and lack of security patches is terribly disappointi…

> choice between "HTTPS being secure" and "supporting insanely old/insecure software", I think there are really three outcomes: 1. HTTPS is widely used, it's secure, insanely old/insecure software is not supported. (Ideal outcome) 2. HTTPS is widely used, but using SHA1 certs for a little longer so that insanely old/insecure software is supported. 3. HTTPS is less widely used, but is secure with SHA2 certs, and insan…

The RC4 deprecation may have more of an effect than this. It's a long-enough timeline, I think.

Nobody should really be issuing certs with SHA-1 anymore - certainly not from next year.

Re: Gradually sunsetting SHA-1

#92

Post by scrollaway »

Alupis wrote: post #86
scrollaway wrote: post #41

Earlier quoted context omitted.

Excellent; this should be another reason for some people to no longer be a client of one of the worst companies in the tech sector today. I'll leave CA recommendations to those who deal with them more than I, but if you use Godaddy as a registrar I would urge you to switch to Gandi.net (or namecheap.com if you cannot afford Gandi).

Google is a decent registrar now that I've moved some domains to them... although I don't know if they offer SSL yet directly, I think they recommend a few 3rd parties though.

Google is only available in the US.

Re: Gradually sunsetting SHA-1

#93

Post by eslaught »

derekerdmann wrote: post #90
eslaught wrote: post #89

Does this mean anything for Git and other VCSs, which uses SHA1 for identifying commits and other blobs? For non-malicious content, you won't care, but if collision attacks are actually feasible, then Git's security guarantees ("you can fetch from anywhere") might potentially be compromised.

This is something Linus addressed quite a while ago: http://lwn.net/Articles/132513/

The critical question is "how broken is SHA1?" Linus essentially bets on it being not broken, or at least, the same degree of broken as the alternatives. At the time that was a reasonable argument. But the numbers quoted in the article [1] seem to point to SHA1 collision attacks being practical within 10 years, and that's based purely on expected hardware advances and not on special hardware acceleration or theoretical breakthroughs.

So I ask again: do we need to revisit this? Just because Linus was dismissive 9 years ago doesn't mean we should ignore the possibility.

[1]: https://www.schneier.com/blog/archives/2012/10/when_will_we_...

Re: Gradually sunsetting SHA-1

#94

Post by yuhong »

hstrauss wrote: post #72
eastdakota wrote: post #29

I'm concerned that the net effect of this will be to make the Internet less secure. In most cases, webmasters will be forced to make a Faustian choice: live with the scary warning in Chrome for modern users or give up support of browsers running on Windows XP (pre-SP3) and early versions of Android (pre-2.3), since they don't support certificates with a more secure hash than SHA1. We'll likely write a blog post soon…

For Windows XP and Server 2003, there is a hotfix: http://support.microsoft.com/kb/968730 This enables SHA-2 certificates. Deployment of the patch is another problem, since it's a HotFix (which may have enterprise-QA issues) and not intended for general use, AFAIK. Still, I've been using it since WS2008 originally came out.

Luckily, MS stripped the GDR branch from all XP/Server 2003 patches one year before XP went out of support, and https://support.microsoft.com/kb/2868626 was released after that was done.

Re: Gradually sunsetting SHA-1

#95

Post by yuhong »

Alupis wrote: post #15

This is about to become a massive issue for Godaddy SSL users[1] seeing that Godaddy has still not added their G2 CA server (which signs all SHA-2 certs at Godaddy) to the default truststore for Java and some other devices/languages/platforms! [1] http://stackoverflow.com/questions/18746565/godaddy-ssl-cert...

There is a cross certificate at https://certs.godaddy.com/anonymous/repository.pki (click on "GoDaddy G1 to G2 Cross Certificate")

Re: Gradually sunsetting SHA-1

#96

Post by yuhong »

AlyssaRowan wrote: post #70
eastdakota wrote: post #29

I'm concerned that the net effect of this will be to make the Internet less secure. In most cases, webmasters will be forced to make a Faustian choice: live with the scary warning in Chrome for modern users or give up support of browsers running on Windows XP (pre-SP3) and early versions of Android (pre-2.3), since they don't support certificates with a more secure hash than SHA1. We'll likely write a blog post soon…

All XP users (including the zillions of pirated ones) can and should upgrade to SP3, free. That leaves aside the question of whether they should still be on the internet, sitting and waiting for the exploit which enables the next "Sapphire". That is going to be a fun day. I'll bring marshmallows. The situation with Android, vendors, old versions, device abandonment and lack of security patches is terribly disappointi…

Also Google does not backport security patches to older Android versions.

Re: Gradually sunsetting SHA-1

#97

Post by Dylan16807 »

v13inc wrote: post #60
agl wrote: post #28

Earlier quoted context omitted.

Just to clarify: the other replies are correct. The logic is that if the leaf certificate has an expiry after Dec 31st, 2015 then the whole chain must be SHA-256. If the leaf expires before that, then other certificates in the chain don't matter. If you have a one year certificate (and I always recommend getting one year certificates so that these issues don't affect you and so that renewal becomes an annual chore, n…

Why can't you just verify that the whole chain is SHA-1 instead of using the expiration date as a heuristic?

Because then everything will seem fine until 2017 at which point all the sites break at once. Using the expiration date makes it gradual and shows problems when certificate updates are tested.

Re: Gradually sunsetting SHA-1

#98

Post by iancarroll »

gergles wrote: post #79
iancarroll wrote: post #68

Earlier quoted context omitted.

Digicert offers SHA2 certificates. It's the default option IIRC. This only applies to end entity certificates, mind you.

It doesn't, it applies to the entire cert chain (minus the root). DigiCert's non-EV intermediate cert (DigiCert Secure Server CA) is SHA1, so until they fix that, all DigiCert users are still going to be affected.

I missed the mention about the chain, sorry.

They do operate an SHA256 intermediary, "DigiCert SHA2 Secure Server CA". They also operate "DigiCert SHA2 Extended Validation Server CA". Both are documented here: https://www.digicert.com/digicert-root-certificates.htm#inte...

Re: Gradually sunsetting SHA-1

#99

Post by serge2k »

eastdakota wrote: post #29

I'm concerned that the net effect of this will be to make the Internet less secure. In most cases, webmasters will be forced to make a Faustian choice: live with the scary warning in Chrome for modern users or give up support of browsers running on Windows XP (pre-SP3) and early versions of Android (pre-2.3), since they don't support certificates with a more secure hash than SHA1. We'll likely write a blog post soon…

XP SP3 was released in 2008 and android 2.3 was released in 2010.

At some point support should be dropped.

Re: Gradually sunsetting SHA-1

#100

Post by flavmartins »

agl wrote: post #37
rdl wrote: post #32

I'm glad to see people move off old browsers, in general. SHA1 is far from the biggest problem with Windows XP SP2; in fact, I'd probably say SHA1 is one of the most secure aspects of the OS. The actual weaknesses in SHA1 which have been identified are very serious, but still requiring on the order of 2^61 operations to cause a collision, and there is a fairly indirect path between hash collision and end of the world…

This was already announced by Microsoft last year: https://technet.microsoft.com/en-us/library/security/2880823... Unfortunately, many CAs decided to ignore it, presumably on the assumption that Microsoft would be forced to back down. We've done this dance with MD5 and 1024-bit certificates and we know how it goes. Here's a quick list of CAs that issued more than 2000 certificates extending into 2017 with SHA-1: Glob…

The claim that CAs have been sitting on SHA-1 and not migrating to SHA-2 is not entirely accurate, at least in my experience with DigiCert.

Consequently, people I know there have told me that 25% of all SHA-2 certs expiring in 2017 have been issued by DigiCert, well beyond their market share. DigiCert has migrated all but a couple hundred customer certificates expiring in 2017 onto SHA-2, and those should be moved soon.

As for CAs in general, much of the blame lies not with CAs but with the lack of SHA-2 compatibility in certain devices and software.

For its part, today, DigiCert released a new, free tool that makes it easy for sys admins to identify all SHA-1 certs in their networks, determine validity periods and how future Chrome releases will treat these certs, and help admins map out a path toward SHA-1 sunsetting and SHA-2 migration.

DigiCert will also replace any SHA-1 certs – for current customers and non-customers alike – for free. They will match the existing SHA-1 term for a free upgrade to SHA-2 through the end of the licensing period. Here’s a link from a Dark Reading article:

http://www.darkreading.com/endpoint/authentication/digicert-....

Post reply on HN