17 ms·
If the cost of creating a collision is $75K, it's far too late to be deprecating SHA1. Even if everyone were to somehow remove SHA1 instantly now, there is stu
by iamsohungry 11y ago
If the cost of creating a collision is $75K, it's far too late to be deprecating SHA1.
Even if everyone were to somehow remove SHA1 instantly now, there is stuff that has (for example) been authenticated using SHA1-HMAC over the last year which will still be relevant for years. It's not hard to think of cases where spoofed messages from a user a year ago are useful to a malicious attacker.
- stock_toaster 11y agoAs to the specific hmac-sha1 construction -- hmac are not simply sha sums. If the hmac key is not shared, the hmac does not solely rely on the collision resistance of the prf. see: https://cseweb.ucsd.edu/~mihir/papers/hmac-new.html https://cseweb.ucsd.edu/~mihir/papers/hmac-new.html
- iamsohungry 11y agoInteresting. The only proof of HMAC efficacy I had seen was one by contradiction, where a false HMAC that validates would imply a collision on the underlying hash. (I'm saying this from memory, which is widely known to be unreliable).
- mtgx 11y agoExactly why Google moved to an "aggressive" timeline to deprecate SHA-1. Schneier predicted the cost of SHA-1 collisions years ago and said criminal groups will be able to create collisions by 2018 - which means you needed to start pushing for killing SHA-1 support years earlier. But when Google did that everyone jumped on them for "trying to control the Internet" or something (because obviously trying to make the Internet adopt stronger security is a power tripping thing). I hope at least now they've seen the error in their ways. Oh, and it turns out Schneier was actually too optimistic about the costs of SHA-1 collissions - by about an order of magnitude: > 211 * 28.4 = 219.4 ~ $700K by 2015 https://www.schneier.com/blog/archives/2012/10/when_will_we_se.html https://www.schneier.com/blog/archives/2012/10/when_will_we_...
- danudey 11y agoAnd Google's push to deprecate SHA-1 to try to drag the internet into modern security practices pales in comparison to Apple's ATS implementation, which has a brutally modern set of minimum requirements (TLS1.2, 256-bit elliptic curve, SHA-256, 2048-bit RSA key). And given Apple's extremely vocal stance on privacy and security, and their 'sudden' addition of ATS, it wouldn't surprise me if ATS became a hard requirement in iOS 10.
- yuhong 11y agoATS has nothing to do with web browsing though.
- bascule 11y agoHMAC tolerates collisions in the underlying hash function. That said, stop using SHA1.