Why it’s harder to forge a SHA-1 certificate than to find a SHA-1 collision
blog.cloudflare.com
Why it’s harder to forge a SHA-1 certificate than to find a SHA-1 collision
1–10 of 46 posts
Re: Why it’s harder to forge a SHA-1 certificate than to find a SHA-1 collision
#2It's worth noting that SHA1 is also suitable for use in HMAC on older hardware, security is not significantly compromised by SHA1's properties.
You can move to more modern algorithms, but there isn't a pressing need to remove SHA1 implementations for that application.
Re: Why it’s harder to forge a SHA-1 certificate than to find a SHA-1 collision
#3Guh, until CF/FB can provide some data that shows users with no upgrade path are genuinely going to be effected by this, and not connections MITM'd by some crappy AV or other random middlebox the LV proposal seems like a pretty silly idea...
https://www.cabforum.org/pipermail/public/2015-December/0064...
Re: Why it’s harder to forge a SHA-1 certificate than to find a SHA-1 collision
#4We're lucky that hash collision attacks have a relatively simple mitigation like this. (Although you have to trust CAs to follow the rules and implement it properly, and events of the last few years indicate that CAs need to have as few things to screw up as possible.)
However, we're not always going to be so lucky. The next major transition in digital certificates could very well be to post-quantum crypto due to advancements in quantum computing. Under that scenario, attackers will be able to simply compute a CA's private key and sign arbitrary certificates. There will be no mitigation short of clients ceasing to trust pre-quantum certs. But clients won't be able to do that unless servers are using post-quantum certs, and server operators won't want to do that if it would mean cutting off legacy clients that don't support post-quantum certs.
The solution to this first mover problem is to set a hard deadline after which legacy certs are retired. This forces clients and server operators to act. Pushing back the SHA-1 deadline at the 11th hour as CloudFlare proposes sends a dangerous message that such deadlines don't have to be taken seriously. This message will come back to haunt the Internet in the future.
Re: Why it’s harder to forge a SHA-1 certificate than to find a SHA-1 collision
#5Nice write-up, but it's slightly misleading or confusing to not explain that Nat McHugh's image collisions were chosen-prefix attacks. The post makes it sound like the images were the product of some unexplained collision, and then goes on to explain how chosen prefix can be used to forge certificates.
Re: Why it’s harder to forge a SHA-1 certificate than to find a SHA-1 collision
#6It's worth noting that SHA1 is also suitable for use in HMAC on older hardware, security is not significantly compromised by SHA1's properties. You can move to more modern algorithms, but there isn't a pressing need to remove SHA1 implementations for that application.
Aren't there more secure hashes than SHA1 that are also faster? Like BLAKE2, which can be configured for 128 or 160 bit output?
Re: Why it’s harder to forge a SHA-1 certificate than to find a SHA-1 collision
#7Odd, I'm getting completely different MD5s from the three example images.
~ curl -s https://blog.cloudflare.com/content/images/2015/08/white.jpg | md5 ~ curl -s https://blog.cloudflare.com/content/images/2015/08/brown.jpg | md5 ~ curl -s https://blog.cloudflare.com/content/images/2015/08/black.jpg | md5Re: Why it’s harder to forge a SHA-1 certificate than to find a SHA-1 collision
#8 $ curl -s https://blog.cloudflare.com/content/images/2015/08/white.jpg | md5
ccf22bc377846166ed65cd3cd58d2e3d
$ curl -s https://blog.cloudflare.com/content/images/2015/08/brown.jpg | md5
810cac197d97da7b216c7883be523495
$ curl -s https://blog.cloudflare.com/content/images/2015/08/black.jpg | md5
6bede506abffe08d0c2406d92fbff393
Re: Why it’s harder to forge a SHA-1 certificate than to find a SHA-1 collision
#9$ curl -s https://blog.cloudflare.com/content/images/2015/08/white.jpg | md5 ccf22bc377846166ed65cd3cd58d2e3d $ curl -s https://blog.cloudflare.com/content/images/2015/08/brown.jpg | md5 810cac197d97da7b216c7883be523495 $ curl -s https://blog.cloudflare.com/content/images/2015/08/black.jpg | md5 6bede506abffe08d0c2406d92fbff393 Let me guess, the CloudFlare CDN is recompressing the images? :D
The original article has the correct images:
$ curl -s http://www.fishtrap.co.uk/black.jpg.coll | md5
b69dd1fd1254868b6e0bb8ed9fe7ecad
$ curl -s http://www.fishtrap.co.uk/brown.jpg.coll | md5
b69dd1fd1254868b6e0bb8ed9fe7ecad
$ curl -s http://www.fishtrap.co.uk/white.jpg.coll | md5
b69dd1fd1254868b6e0bb8ed9fe7ecadRe: Why it’s harder to forge a SHA-1 certificate than to find a SHA-1 collision
#10$ curl -s https://blog.cloudflare.com/content/images/2015/08/white.jpg | md5 ccf22bc377846166ed65cd3cd58d2e3d $ curl -s https://blog.cloudflare.com/content/images/2015/08/brown.jpg | md5 810cac197d97da7b216c7883be523495 $ curl -s https://blog.cloudflare.com/content/images/2015/08/black.jpg | md5 6bede506abffe08d0c2406d92fbff393 Let me guess, the CloudFlare CDN is recompressing the images? :D
[deleted]