4 ms·
This is a classic case of the perfect vs the good. The question is not whether SHA1 is “acceptable”, but whether it is better than the alternative, which is pla
by mwsherman 11y ago
This is a classic case of the perfect vs the good. The question is not whether SHA1 is “acceptable”, but whether it is better than the alternative, which is plain text for users that cannot do SHA256. It’s graceful degradation.
The number quoted of $70K to crack SHA1 indicates that it is non-trivial to hack. Which means adversaries could break the encryption, but could only afford to attack a small number of people. Which means that SHA1 is effective for a large majority.
- geofft 11y agoIt's $70K per certificate you're colliding, not $70K per user. A single expenditure of $70K before the end of the year gets you a valid SHA-1 facebook.com certificate with your own private key, which you can use in as many MITMs as you want. (That is, this is not an attack on the encryption, where it's $70K to decrypt a conversation; it's an attack on the signature of the certificate.)
- michaelt 11y agoThere are loads of millionaires and rich companies with an interest in security in Silicon Valley. Why haven't any of them made us a proof-of-concept certificate?
- pritambaral 11y agoI suppose because this is a concept that doesn't need a test of truth anymore to be proven. It is accepted and easy enough to be verified mathematically.
- agwa 11y ago> Which means adversaries could break the encryption, but could only afford to attack a small number of people No, because an attacker could forge a single CA certificate that could then be used to sign certificates for an unlimited number of websites. This is what the MD5 attack did: https://www.win.tue.nl/hashclash/rogue-ca/ https://www.win.tue.nl/hashclash/rogue-ca/
- makomk 11y agoThat attack shouldn't work these days even if you can achieve a hash collision. It requires the ability to predict the entire contents of the certificate issued by the CA and I think CAs have since moved to using unpredictable serial numbers in order to prevent this.
- agwa 11y agoAlas, random serial numbers are only a "SHOULD" in the Baseline Requirements, and not all CAs use them.
- gozo 11y agoI'd like to think that a secure Internet is not too "perfect", but rather that an insecure one is broken and should be fixed.
- mwsherman 11y ago[too late to edit] My understanding of what a cracked SHA1 amounts to (per cert, not per user) was wrong. Seems obvious after explanation. Thanks.