6 ms·

SHA1 sunset will block millions from encrypted net, Facebook warns

42 points by pavornyoh 11y ago

KenanSulayman 11y ago
Well, you can just keep it plain-text if you're going to be using SHA1. So don't worry about these people.
- rmdoss 11y ago
  Not at all. Attacks against SHA1 on the HTTPS-context are really hard and mostly not practical to pull it off.
vaadu 11y ago
The internet can never get more secure if it has to cater to the least secure.
- cuckcuckspruce 11y ago
  Agreed. At least if things break noisily then the user will have an idea that things are now different. If you silently fall back with no feedback to the user then they may never know that they should have lessened security expectations.
- geofft 11y ago
  In this particular case, Facebook is advocating for using a SHA-1 certificate only if they know that the client doesn't support SHA-256, and if that knowledge is cryptographically protected. Since TLS supports a way of securely detecting MITMs in the handshake, you can in fact get the client TLS version in a trustworthy manner. This prevents SHA-1 attacks on clients that support SHA-256 (which was the goal all along), while continuing to provide non-plaintext service to clients that don't. It's not at all clear to me that this prevents the internet from getting more secure.
  - ceejayoz 11y ago
    > It's not at all clear to me that this prevents the internet from getting more secure. It means people can keep using their insecure clients instead of being forced to upgrade to something secure.
  - agwa 11y ago
    > In this particular case, Facebook is advocating for using a SHA-1 certificate only if they know that the client doesn't support SHA-256, and if that knowledge is cryptographically protected. Since TLS supports a way of securely detecting MITMs in the handshake, you can in fact get the client TLS version in a trustworthy manner. This prevents SHA-1 attacks on clients that support SHA-256 (which was the goal all along), while continuing to provide non-plaintext service to clients that don't. Their proposal doesn't actually stop SHA-1 attacks. If an attacker can forge a SHA-1 cert, they can set up a MitM in which the victim talks exclusively to the attacker's server. Facebook's servers won't be contacted, so the downgrade-proof logic on Facebook's servers won't even be executed. The attacker's server will present only the forged SHA-1 certificate, which web browsers will accept in the name of backwards compatibility. Long-term, browsers will stop accepting SHA-1 certificates, but this is not scheduled to happen until 2017. > It's not at all clear to me that this prevents the internet from getting more secure. Two ways this prevents the Internet from getting more secure: 1. Their proposal would make it possible to obtain SHA-1 certificates past December 31, 2015, which means there's more time for an attacker to exploit a collision to forge a cert. It's important to understand that exploiting a SHA-1 collision requires a certificate authority to issue you a certificate, so if no one is able to find a SHA-1 collision in the next 19 days, the Internet will be safe from SHA-1 collisions in 2016 even if browsers continue to accept SHA-1 certificates until 2017. Allowing continued SHA-1 issuance removes this safety net. 2. It sends the message to companies that deadlines can be ignored because they'll be pushed back at the last minute. This will make it difficult to deprecate insecure practices in the future.
    - geofft 11y ago
      Facebook's proposal is that only organizations that are a) demonstrably using this technique and b) validated at a higher level than automatic domain validation be allowed to get new SHA-1 certs. This means that an attacker will have to identify themselves fairly strongly in order to conduct a collision attack. It is a vast improvement from anyone being able to register a random new domain name and get a SHA-1 cert for it. It's probably not a huge roadblock for a superpower's well-funded intelligence agency, but I think that the threat model is not primarily about protecting against them. I agree about the political part of the issue, but on the other hand, the SHA-1 deprecation is one of the most proactive things the CA/Browser Forum has done. Having it go not quite perfectly is still a vast improvement from reactively deprecating things only when they are fully insecure.
- breadtk 11y ago
  Facebook's user base as of January 2014 was at 1.24B monthly users[1]. According to FB's post, up to 7% of their users do not support SHA2 certs. This would mean approximately 86.8m FB users alone would affected by full-stop SHA1 degradation. I'm happy to see FB has implemented a mechanism selective cert selection and other organizations that care about their user's security ought to look at them for a model on how to approach this methodically. SHA1 isn't great, but it is certainly better than plaintext communications. [1] http://thenextweb.com/facebook/2014/01/29/facebook-passes-1-23-billion-monthly-active-users-945-million-mobile-users-757-million-daily-users/ http://thenextweb.com/facebook/2014/01/29/facebook-passes-1-...
  - cdcarter 11y ago
    If it's broken (which it is), it is no better than plaintext.
    - mehrdada 11y ago
      I'm personally on your side of the argument and against Facebook's stance, but this statement is strictly speaking not true. At worst, it will be equivalent to protection provided by an encryption scheme without authenticating the other party and it defeats passive attackers. That's not quite as bad as sending plaintext (in practice, it is much much better when it applies to the internet broadly: cf. firesheep). P.S. that's basically the state of SMTP encryption, which is quite sad.
    - breadtk 11y ago
      It isn't _completely_ broken. That is why FB is still advocating for a two tiered approach (SHA2 when possible, SHA1 everywhere else). SHA1 hash collisions are indeed now within the range of well funded governments, but it is not within the range of your average script kiddie to find possible collisions. To prove my point, I'd ask you to find an arbitrary Root CA cert which uses SHA1 hash and attempt to clone it. I think you'll find that this takes still a considerable amount of effort and/or it is completely out of reach. I should be clear that SHA1 shouldn't be used for cryptographic purposes that require high amount of trust, but for your average everyday FB status updates it is probably fine when coupled with other protections.
deleted 11y ago
[deleted]
DyslexicAtheist 11y ago
the only interesting / relevant part of this article are the comments.
nivla 11y ago
Interestingly I was all for this until one day when I wasn't able to log into my Router's page. The router used a self signed SHA1 certificate and Chrome outright refused to render it. Gladly the router was open to dd-wrt and I was able to replace the certificate manually. However I wonder how many other devices are there which people can't update that may be affected because of this.
- dredmorbius 11y ago
  I'm in precisely the same boat, with a Linksys WRT54g router. Linksys have no firmware update for this device. Looks like dd-wrt (or another alternative) is the way to fly.
  - justinsaccount 11y ago
    You've been running an obsolete firmware on an obsolete device for what I imagine is years. A wrt54g doesn't have gigabit ethernet, doesn't support 802.11N or AC.. The last one I used topped out at 50mbit on a single connection. Those things were good for a while, but unless the rest of your hardware is from 2008, you probably owe it to yourself to upgrade.
    - dredmorbius 11y ago
      Funny thing is: the device is sufficient for the use. It's attached to a DSL connection that's far slower than it, and largely ties together a small number of client systems which communicate exclusively with the Internet gateway (no local traffic). Oh, and the folks who own the system itself would have absolutely no idea of what any of the items in your second sentence mean, or what they'd matter to them (if the features mattered at all to them, which they in fact don't). There's no GigE on the property. If they had a Web-only system they'd probably be ahead of the game (less shit to go wrong), and wireless bands supported work fine with devices connecting to it. Point is, there's a piece of perfectly _suitable_ and _usable_ hardware that's running just fine at the job for which it was originally intended, but the manufacturer's abandoned it. Something I strongly suspect we'll be seeing rather more of in the coming age of the Internet of Broken Things That Spy on You. But, say you've sold me: what's a decent replacement. And a Free-Software based ROM to put on it (I'd like to put extensive blocklisting on the gateway device itself).
yuhong 11y ago
I was proposing normal OV SHA1 certs, the key being to restrict to manual issuance to reduce risk and to discourage use. The RapidSSL MD5 collision attack was against automated DV cert issuing and would be obvious to people manually processing CSRs.
mwsherman 11y ago
This is a classic case of the perfect vs the good. The question is not whether SHA1 is “acceptable”, but whether it is better than the alternative, which is plain text for users that cannot do SHA256. It’s graceful degradation. The number quoted of $70K to crack SHA1 indicates that it is non-trivial to hack. Which means adversaries could break the encryption, but could only afford to attack a small number of people. Which means that SHA1 is effective for a large majority.
- geofft 11y ago
  It's $70K per certificate you're colliding, not $70K per user. A single expenditure of $70K before the end of the year gets you a valid SHA-1 facebook.com certificate with your own private key, which you can use in as many MITMs as you want. (That is, this is not an attack on the encryption, where it's $70K to decrypt a conversation; it's an attack on the signature of the certificate.)
  - michaelt 11y ago
    There are loads of millionaires and rich companies with an interest in security in Silicon Valley. Why haven't any of them made us a proof-of-concept certificate?
    - pritambaral 11y ago
      I suppose because this is a concept that doesn't need a test of truth anymore to be proven. It is accepted and easy enough to be verified mathematically.
- agwa 11y ago
  > Which means adversaries could break the encryption, but could only afford to attack a small number of people No, because an attacker could forge a single CA certificate that could then be used to sign certificates for an unlimited number of websites. This is what the MD5 attack did: https://www.win.tue.nl/hashclash/rogue-ca/ https://www.win.tue.nl/hashclash/rogue-ca/
0x0 11y ago
Could the risk of SHA1 be mitigated by re-issuing certificates daily and having 24 hours expiration dates? Or would any attacker be able to set whatever they please for the expiration date if they find a collision?
justinsaccount 11y ago
Every time the subject of obsolete or un-upgradeable devices comes up it is pointed out that the people that buy these devices "don't care". They don't care about android 6.0, they are happy with their $10 device running android 4.whatever that is vulnerable to who knows what. So, probably not a popular opinion, but screw em. Maybe when they buy a replacement device they will ask "Will this thing be obsolete in a year like the last one or will it actually get software updates?" "Will I be able to install a different ROM on this or is the bootloader locked?
- colanderman 11y ago
  Ya that's a pretty hard judgement to make when Google's own devices aren't even supported for more than one major version. Even the G1 didn't make it to 2.0.

42 points by pavornyoh 11y ago

KenanSulayman 11y ago

Well, you can just keep it plain-text if you're going to be using SHA1. So don't worry about these people.

rmdoss 11y ago
Not at all. Attacks against SHA1 on the HTTPS-context are really hard and mostly not practical to pull it off.

vaadu 11y ago

The internet can never get more secure if it has to cater to the least secure.

cuckcuckspruce 11y ago
Agreed. At least if things break noisily then the user will have an idea that things are now different. If you silently fall back with no feedback to the user then they may never know that they should have lessened security expectations.
geofft 11y ago
In this particular case, Facebook is advocating for using a SHA-1 certificate only if they know that the client doesn't support SHA-256, and if that knowledge is cryptographically protected. Since TLS supports a way of securely detecting MITMs in the handshake, you can in fact get the client TLS version in a trustworthy manner. This prevents SHA-1 attacks on clients that support SHA-256 (which was the goal all along), while continuing to provide non-plaintext service to clients that don't. It's not at all clear to me that this prevents the internet from getting more secure.
- ceejayoz 11y ago
  > It's not at all clear to me that this prevents the internet from getting more secure. It means people can keep using their insecure clients instead of being forced to upgrade to something secure.
- agwa 11y ago
  > In this particular case, Facebook is advocating for using a SHA-1 certificate only if they know that the client doesn't support SHA-256, and if that knowledge is cryptographically protected. Since TLS supports a way of securely detecting MITMs in the handshake, you can in fact get the client TLS version in a trustworthy manner. This prevents SHA-1 attacks on clients that support SHA-256 (which was the goal all along), while continuing to provide non-plaintext service to clients that don't. Their proposal doesn't actually stop SHA-1 attacks. If an attacker can forge a SHA-1 cert, they can set up a MitM in which the victim talks exclusively to the attacker's server. Facebook's servers won't be contacted, so the downgrade-proof logic on Facebook's servers won't even be executed. The attacker's server will present only the forged SHA-1 certificate, which web browsers will accept in the name of backwards compatibility. Long-term, browsers will stop accepting SHA-1 certificates, but this is not scheduled to happen until 2017. > It's not at all clear to me that this prevents the internet from getting more secure. Two ways this prevents the Internet from getting more secure: 1. Their proposal would make it possible to obtain SHA-1 certificates past December 31, 2015, which means there's more time for an attacker to exploit a collision to forge a cert. It's important to understand that exploiting a SHA-1 collision requires a certificate authority to issue you a certificate, so if no one is able to find a SHA-1 collision in the next 19 days, the Internet will be safe from SHA-1 collisions in 2016 even if browsers continue to accept SHA-1 certificates until 2017. Allowing continued SHA-1 issuance removes this safety net. 2. It sends the message to companies that deadlines can be ignored because they'll be pushed back at the last minute. This will make it difficult to deprecate insecure practices in the future.
  - geofft 11y ago
    Facebook's proposal is that only organizations that are a) demonstrably using this technique and b) validated at a higher level than automatic domain validation be allowed to get new SHA-1 certs. This means that an attacker will have to identify themselves fairly strongly in order to conduct a collision attack. It is a vast improvement from anyone being able to register a random new domain name and get a SHA-1 cert for it. It's probably not a huge roadblock for a superpower's well-funded intelligence agency, but I think that the threat model is not primarily about protecting against them. I agree about the political part of the issue, but on the other hand, the SHA-1 deprecation is one of the most proactive things the CA/Browser Forum has done. Having it go not quite perfectly is still a vast improvement from reactively deprecating things only when they are fully insecure.
breadtk 11y ago
Facebook's user base as of January 2014 was at 1.24B monthly users[1]. According to FB's post, up to 7% of their users do not support SHA2 certs. This would mean approximately 86.8m FB users alone would affected by full-stop SHA1 degradation. I'm happy to see FB has implemented a mechanism selective cert selection and other organizations that care about their user's security ought to look at them for a model on how to approach this methodically. SHA1 isn't great, but it is certainly better than plaintext communications. [1] http://thenextweb.com/facebook/2014/01/29/facebook-passes-1-23-billion-monthly-active-users-945-million-mobile-users-757-million-daily-users/ http://thenextweb.com/facebook/2014/01/29/facebook-passes-1-...
- cdcarter 11y ago
  If it's broken (which it is), it is no better than plaintext.
  - mehrdada 11y ago
    I'm personally on your side of the argument and against Facebook's stance, but this statement is strictly speaking not true. At worst, it will be equivalent to protection provided by an encryption scheme without authenticating the other party and it defeats passive attackers. That's not quite as bad as sending plaintext (in practice, it is much much better when it applies to the internet broadly: cf. firesheep). P.S. that's basically the state of SMTP encryption, which is quite sad.
  - breadtk 11y ago
    It isn't _completely_ broken. That is why FB is still advocating for a two tiered approach (SHA2 when possible, SHA1 everywhere else). SHA1 hash collisions are indeed now within the range of well funded governments, but it is not within the range of your average script kiddie to find possible collisions. To prove my point, I'd ask you to find an arbitrary Root CA cert which uses SHA1 hash and attempt to clone it. I think you'll find that this takes still a considerable amount of effort and/or it is completely out of reach. I should be clear that SHA1 shouldn't be used for cryptographic purposes that require high amount of trust, but for your average everyday FB status updates it is probably fine when coupled with other protections.

deleted 11y ago

[deleted]

DyslexicAtheist 11y ago

the only interesting / relevant part of this article are the comments.

nivla 11y ago

Interestingly I was all for this until one day when I wasn't able to log into my Router's page. The router used a self signed SHA1 certificate and Chrome outright refused to render it. Gladly the router was open to dd-wrt and I was able to replace the certificate manually. However I wonder how many other devices are there which people can't update that may be affected because of this.

dredmorbius 11y ago
I'm in precisely the same boat, with a Linksys WRT54g router. Linksys have no firmware update for this device. Looks like dd-wrt (or another alternative) is the way to fly.
- justinsaccount 11y ago
  You've been running an obsolete firmware on an obsolete device for what I imagine is years. A wrt54g doesn't have gigabit ethernet, doesn't support 802.11N or AC.. The last one I used topped out at 50mbit on a single connection. Those things were good for a while, but unless the rest of your hardware is from 2008, you probably owe it to yourself to upgrade.
  - dredmorbius 11y ago
    Funny thing is: the device is sufficient for the use. It's attached to a DSL connection that's far slower than it, and largely ties together a small number of client systems which communicate exclusively with the Internet gateway (no local traffic). Oh, and the folks who own the system itself would have absolutely no idea of what any of the items in your second sentence mean, or what they'd matter to them (if the features mattered at all to them, which they in fact don't). There's no GigE on the property. If they had a Web-only system they'd probably be ahead of the game (less shit to go wrong), and wireless bands supported work fine with devices connecting to it. Point is, there's a piece of perfectly _suitable_ and _usable_ hardware that's running just fine at the job for which it was originally intended, but the manufacturer's abandoned it. Something I strongly suspect we'll be seeing rather more of in the coming age of the Internet of Broken Things That Spy on You. But, say you've sold me: what's a decent replacement. And a Free-Software based ROM to put on it (I'd like to put extensive blocklisting on the gateway device itself).

yuhong 11y ago

I was proposing normal OV SHA1 certs, the key being to restrict to manual issuance to reduce risk and to discourage use. The RapidSSL MD5 collision attack was against automated DV cert issuing and would be obvious to people manually processing CSRs.

mwsherman 11y ago

This is a classic case of the perfect vs the good. The question is not whether SHA1 is “acceptable”, but whether it is better than the alternative, which is plain text for users that cannot do SHA256. It’s graceful degradation. The number quoted of $70K to crack SHA1 indicates that it is non-trivial to hack. Which means adversaries could break the encryption, but could only afford to attack a small number of people. Which means that SHA1 is effective for a large majority.

geofft 11y ago
It's $70K per certificate you're colliding, not $70K per user. A single expenditure of $70K before the end of the year gets you a valid SHA-1 facebook.com certificate with your own private key, which you can use in as many MITMs as you want. (That is, this is not an attack on the encryption, where it's $70K to decrypt a conversation; it's an attack on the signature of the certificate.)
- michaelt 11y ago
  There are loads of millionaires and rich companies with an interest in security in Silicon Valley. Why haven't any of them made us a proof-of-concept certificate?
  - pritambaral 11y ago
    I suppose because this is a concept that doesn't need a test of truth anymore to be proven. It is accepted and easy enough to be verified mathematically.
agwa 11y ago
> Which means adversaries could break the encryption, but could only afford to attack a small number of people No, because an attacker could forge a single CA certificate that could then be used to sign certificates for an unlimited number of websites. This is what the MD5 attack did: https://www.win.tue.nl/hashclash/rogue-ca/ https://www.win.tue.nl/hashclash/rogue-ca/

0x0 11y ago

Could the risk of SHA1 be mitigated by re-issuing certificates daily and having 24 hours expiration dates? Or would any attacker be able to set whatever they please for the expiration date if they find a collision?

justinsaccount 11y ago

Every time the subject of obsolete or un-upgradeable devices comes up it is pointed out that the people that buy these devices "don't care". They don't care about android 6.0, they are happy with their $10 device running android 4.whatever that is vulnerable to who knows what. So, probably not a popular opinion, but screw em. Maybe when they buy a replacement device they will ask "Will this thing be obsolete in a year like the last one or will it actually get software updates?" "Will I be able to install a different ROM on this or is the bootloader locked?

colanderman 11y ago
Ya that's a pretty hard judgement to make when Google's own devices aren't even supported for more than one major version. Even the G1 didn't make it to 2.0.