Why Google is Hurrying the Web to Kill SHA-1
konklone.com
Why Google is Hurrying the Web to Kill SHA-1
1–10 of 136 posts
Re: Why Google is Hurrying the Web to Kill SHA-1
#2Two nits, both pedantic:
An attack on SHA1 that makes certificate forgery viable within the next few years doesn't seem very likely, although over the long term it might be. The attack on SHA1 isn't like the attacks on RSA-1024; my sense is that the literature already knows how to break RSA-1024 given enough compute, but does not know how to do that with SHA1. Further, factoring RSA-1024 provides an attacker with a total break of RSA-1024 TLS, but not every attack on SHA1 will necessarily do the same.
Second, there's a subtext that SHA-3 having been standardized somehow puts the writing on the wall (albeit, a far-away wall) for SHA-2. Not so; SHA-2 could remain secure (in its TLS certificate use case) indefinitely.
Re: Why Google is Hurrying the Web to Kill SHA-1
#3Also its not exactly fair to compare the Flame attack on MD5 and compare it immediately to SHA-1. Unless you are the US or China you likely don't have the resources necessary to pull off that sort of attack.
The Flame attack's math was invented by an internal government cryptographic think tank. And still had to leverage massive computational power, just not in the order of 100's of millions.
The idea a rogue group who have access to (both of) these resources is slightly idiotic. It would be far easier for them to attack RSA directly if you had 10's of millions of dollars of computers. There are a lot of 1024 bit certs you could pick off for easy profit.
Re: Why Google is Hurrying the Web to Kill SHA-1
#4[deleted]
Re: Why Google is Hurrying the Web to Kill SHA-1
#5 Everyone is vulnerable: https://www.google.com, https://www.facebook.com, https://www.svyft.com as per the link provided in the article (https://shaaaaaaaaaaaaa.com)
Re: Why Google is Hurrying the Web to Kill SHA-1
#6Also its not exactly fair to compare the Flame attack on MD5 and compare it immediately to SHA-1. Unless you are the US or China you likely don't have the resources necessary to pull off that sort of attack. The Flame attack's math was invented by an internal government cryptographic think tank. And still had to leverage massive computational power, just not in the order of 100's of millions. The idea a rogue group w…
Botnet.
Re: Why Google is Hurrying the Web to Kill SHA-1
#7Everyone is vulnerable: https://www.google.com , https://www.facebook.com , https://www.svyft.com as per the link provided in the article ( https://shaaaaaaaaaaaaa.com )
Vulnerable to what? Perhaps better to say, "everyone would be vulnerable".
Re: Why Google is Hurrying the Web to Kill SHA-1
#8Can someone post a summary of the part of the story hinted to by the headline? I couldn't find it.
Re: Why Google is Hurrying the Web to Kill SHA-1
#9Everyone is vulnerable: https://www.google.com , https://www.facebook.com , https://www.svyft.com as per the link provided in the article ( https://shaaaaaaaaaaaaa.com )
Luckily shaaaaaaaaaaaaa.com itself is fine: https://shaaaaaaaaaaaaa.com/check/shaaaaaaaaaaaaa.com
Re: Why Google is Hurrying the Web to Kill SHA-1
#10Also its not exactly fair to compare the Flame attack on MD5 and compare it immediately to SHA-1. Unless you are the US or China you likely don't have the resources necessary to pull off that sort of attack. The Flame attack's math was invented by an internal government cryptographic think tank. And still had to leverage massive computational power, just not in the order of 100's of millions. The idea a rogue group w…
Botnet.
Exactly.