[openssl-users] Rejecting SHA-1 certificates
Michael Wojcik
Michael.Wojcik at microfocus.com
Mon Jul 10 17:30:25 UTC 2017
> From: openssl-users [mailto:openssl-users-bounces at openssl.org] On Behalf Of Niklas Keller
> Sent: Monday, July 10, 2017 11:12
> To: openssl-users at openssl.org
> Subject: Re: [openssl-users] Rejecting SHA-1 certificates
> It's very well worth the effort, otherwise there's a security issue, because certificates can be forged.
Care to demonstrate that?
The SHAttered attack demonstrated an SHA1 collision using 1) an enormous amount of resources and 2) a file format with plenty of scope for manipulating the preimages. I'm not aware of any public demonstration showing anything close to a practical way of forging an X.509 certificate with an SHA1-based signature. Certificates have far less scope for manipulating the preimage.
It's always been possible to forge certificates. Generally that's been done by stealing the signing key from a poorly-secured CA. The new marginal feasibility of producing SHA1 collisions does not significantly increase the forgery risk for X.509 certificates at present, since it's probably still too difficult - perhaps not even possible for any useful forgery (if the forged certificate had to carry a suspect amount of unexpected data, for example) - and certainly far too expensive to justify the vast majority of potential attacks.
A security vulnerability is meaningless outside the context of a threat model. Forging certificates with SHA1-based signatures is a very minor branch of the attack tree for nearly all certificate holders. CAs and browser vendors are getting rid of SHA1-based signatures now because the cost of being proactive is very small, and attacks only get better. That doesn't mean immediately screening out all SHA1-based certificates is justified under sensible threat models.
What's your threat model, and how does it justify this effort?
Michael Wojcik
Distinguished Engineer, Micro Focus
More information about the openssl-users
mailing list