9 ms·
Microsoft ‘Mortally Wounds’ SHA-1
- andrewaylett 13y agoI'm in two minds about this: it's great that we're going to be able to move forward, but I'm not sure about one organisation having the power to unilaterally dictate to everyone and expect people to listen to them. Also, I imagine that people are still generating SHA-1 certs out of a (possibly misguided) sense of remaining compatible with old devices. Anyone know what impact this might have?
- praseodym 13y agoMicrosoft only supports SHA-2 since Windows XP SP3 and Windows Server 2003 with a hotfix (which needs to be downloaded separately!). So ironically, Microsoft's (old but still supported) products are the main reason that people are still generating SHA-1 certificates.
- AaronFriel 13y agoThe Windows Server 2003 hotfix addresses being able to receive and utilize an SHA-2 certificate, so unless you're suggesting the vast majority of webservers are WS2003, I'm guessing not. As for Windows XP, SP3 supports it without a hotfix, and SP3 has been out for 5 years, and it's currently the only supported branch of XP. Really the problem is just that the security industry moves very slowly, and when it does it lurches forward unpredictably because of the sudden release of a viable attack. As Microsoft suggests, a preimage attack could debilitate online security and would force a much more haphazard (and risky) move to new certificates. I expect >99% of web-browsing computers support SHA-2 these days, so there's no reason to allow the CA industry to continue limping along. So, ironically, it's Microsoft that will force the industry to move forward for once.
- yuhong 13y agoAnd as it happens, the Server 2003 hotfix required to support SHA256 certs and the XP/Server 2003 hotfix required for enrollment of SHA256 certificates (not that it matters as much as only the machine enrolling SHA256 certs needs it) are both included in MS13-095, because they stripped the GDR branch from new XP/Server 2003 updates ~6 months ago.
- jamra 13y agoKilling off weak encryption is absolutely necessary. Sha-1 is hard-coded into their RSA implementation in the dotnet library. Without doing this in a total way, they wouldn't be able to do it at all. Now all the internal Microsoft fiefdoms will have to comply.
- Pxtl 13y agoSeriously? I don't do much encryption, but which .NET framework lib still uses Sha-1? Of course, this is one of those cases where I'd imagine that MS's approach to protecting backwards compat will mean nothing but a warning thrown when you reference the old lib, and any new libraries sport a completely different API making them unsuitable as a drop-in replacement. MS protects compatibility religiously while simultaneously applying a Not Invented Here mentality to code that actually was Invented Here.
- jamra 13y agoRSACryptoServiceProvider uses Sha-1. It does not ask for a hash function. I learned this recently while trying to port over a client C# program to Golang.
- Locke1689 13y agoThis is not true. http://msdn.microsoft.com/en-us/library/9tsc5d0z(v=vs.110).aspx http://msdn.microsoft.com/en-us/library/9tsc5d0z(v=vs.110).a... The second parameter is the digest algorithm.
- jamra 13y agoThat's if you sign the data. If you just run Decrypt, it does not ask for a hash function. Under the hood, it uses Sha-1. Edit: Here is a link to the golang implementation http://golang.org/pkg/crypto/rsa/#DecryptOAEP http://golang.org/pkg/crypto/rsa/#DecryptOAEP It takes a hash as the first param Here is the C# counterpart http://msdn.microsoft.com/en-us/library/system.security.cryptography.rsa.decryptvalue(v=vs.110).aspx http://msdn.microsoft.com/en-us/library/system.security.cryp... It does not take in a hash function though I believe you can modify how it works although I never tried to. I wasn't referring to explicitly signing the data.
- forgottenpass 13y agobut I'm not sure about one organisation having the power to unilaterally dictate to everyone and expect people to listen to them. Isn't revving SHA kind of a triviality compared to all the other things Microsoft and other big guys use their market position to force through?
- andrewaylett 13y agoIt's the 'expect people to listen to them' bit that I'm less sure of. Most of the other things you're referring to are rather more obviously purely for the benefit of the instigator, and they can compel people to listen. In this case, the change should actually benefit the community. Again, they can compel people to listen but I sort of get the impression that they're expecting people to be happy about the change. Indeed, I'm not going to complain too loudly especially as none of my certificates have a far enough out expiry to be affected. I suppose my point is that even if you think everyone will be pleased at a change you're making, if you want people to be happy you should probably check with them before acting.
- yesiamyourdad 13y ago"one organisation having the power to unilaterally dictate to everyone and expect people to listen to them" In tech frequently a benevolent dictatorship is the only way to get things done. They could take this through the IETF or ICANN or something but they'd spend 5 years listening to people prattle on about edge cases while SHA-1 becomes progressively less secure. I worked with airlines for a number of years and the amount of effort spent trying to keep old devices alive on their networks FAR exceeds what it would've cost to just upgrade the devices.
- salient 13y agoNow how about you "mortally wound" Skype's (in)security model, Microsoft? No end-to-end security = no security.
- peterwwillis 13y ago> Error establishing a database connection STOP REQUIRING DATABASE CONNECTIONS TO SERVE STATIC CONTENT!
- forgottenpass 13y agoEverything is going to be OK.
- lstamour 13y agoI just used a google cache: http://webcache.googleusercontent.com/search?q=cache:Mv3YNrjD0gwJ:blog.gerv.net/2013/11/microsoft-mortally-wounds-sha-1/+&cd=2&hl=en&ct=clnk http://webcache.googleusercontent.com/search?q=cache:Mv3YNrj...
- deleted 13y ago[deleted]
- kzrdude 13y agoIs Intel still going to add SHA-1 specific instructions to their next chip? I'm hoping for that to be reversed.
- api 13y agoAES-specific instructions were even a bit questionable... but this is highly questionable. Algorithm-specific instructions are basically going to become very dated cruft within a few years to a decade tops and are probably a bad thing to add to any instruction set. Better would be to add instructions for speeding up all sorts of crypto algorithms.
- steve19 13y agoThey can just implement cruft in microcode rather than silicon. In the meantime everyone using AES for full disk encryption gets a nice speedup.
- geofft 13y agoAES-specific instructions are also the only sane way to implement AES without timing attacks. I'm curious about this "instructions for speeding up all sorts of crypto algorithms" proposal -- how would you do that, given that crypto algorithms tend to have a wide variety of implementations and a wide variety of mathematical underpinnings? Do you want instructions that speed up all sorts of math?
- tptacek 13y agoI'm not sure that's true. Maybe you're thinking about implementing GCM without lookup tables; GCM is most often considered in AES context, and is infamously tricky to do in software in constant time and reasonable speed.
- geofft 13y agoI might have it confused? I thought there were cache-timing issues with doing lookups in the S-box in RAM, for instance. I certainly also buy that the Intel GCM acceleration functions are useful.
- aetherson 13y agoIs that 98% of all internet certificates use SHA-1 statistic true?
- moyix 13y agoAccording to this EFF presentation [1] (slide 24) where they scanned the internet for SSL servers in 2010, it's actually an underestimate -- in fact around 99.995% of servers use SHA1. The query shown only considers certs created in 2010, though; I'm grabbing the data set to verify now, but I suspect that 98% is not unreasonable. Edit: Here's the full data. ~99%: mysql> SELECT `Signature Algorithm`, count(*) FROM valid_certs GROUP BY `Signature Algorithm`; +--------------------------+----------+ | Signature Algorithm | count(*) | +--------------------------+----------+ | md2WithRSAEncryption | 4 | | md5WithRSAEncryption | 13942 | | sha1WithRSA | 3 | | sha1WithRSAEncryption | 1441335 | | sha256WithRSAEncryption | 106 | | sha512WithRSAEncryption | 1 | +--------------------------+----------+ [1] https://www.eff.org/files/ccc2010.pdf https://www.eff.org/files/ccc2010.pdf
- aetherson 13y agoJesus. Thanks for the data!
- ben0x539 13y agoI hope all my sha-1 hashed git commit ids are gonna be okay. :(
- mackal 13y agoUnless you are trying to make a joke with the title of the post, sha-1 not related to certificates will be unaffected.
- graue 13y agoUnaffected by Microsoft's announcement, yes. However, they will be affected by any successful preimage [edit: or collision] attacks on SHA-1, and the possibility of such an attack appears to motivate Microsoft's announcement.
- api 13y agoEven if SHA-1 were weakened considerably, this would not impact this particular use case all that much... except in cases where git hashes are used in a security-critical way. (Which is probably not that great an idea...)
- MichaelGG 13y agoDoesn't a signed git tag rely on signing the 160-bit hash? So if SHA-1 was really weakened, you could reuse a signature by generating a repo that hashes to the same value as the signed one?
- csense 13y ago> git hashes are used in a security-critical way Verifying the integrity of the source code of e.g. the Linux kernel is pretty security-critical.
- deleted 13y ago[deleted]
- taf2 13y agoI'm cool with their change if they also auto upgrade all WinXP users.
- justin66 13y agoWindows XP users will have been without support for a couple of years before this becomes relevant. Extended support for XP ends on April 8, 2014.
- yuhong 13y agoXP SP3 already have support.
- JohnTHaller 13y agoWindows XP already has support via a hotfix. Windows XP dies in 144 days, anyway, so anyone left using it by the time this takes effect will be using a hopelessly insecure system for some time already.
- dontmakemelaugh 13y agoit won't die. it will be used for years by millions of users. that some company stops issuing security updates for a software means nothing to most users. it probably will even make them more happy because they are not nagged by update messages all the time.
- TazeTSchnitzel 13y agoYep. PHP 5.1 and 5.2 are still widely deployed :(
- JohnTHaller 13y agoPeople can still use it. But it's dead, insecure, and unsupported. Just like Windows 3.x, 95, NT, 98, 98se, 2000, etc. People still use all of those, too.
- deleted 13y ago[deleted]
- ck2 13y agoShouldn't the title be "Microsoft ‘Mortally Wounds’ Windows" ? I mean it is only windows affected. And I bet browsers other than IE will work.
- geofft 13y agoYes, website operators that don't have any Windows users they care about aren't affected. All three of them. Somewhat more relevantly, CAs that don't have any customers who have any Windows users they care about aren't affected. That's probably closer to zero.
- api 13y agoPersonally I think the risk that CAs are or will be compromised is much higher than the risk of a practical SHA-1 preimage attack. The entire CA model is very shaky. MS has a history of helping out its buddies in the certificate troll mafia. This seems like it kind of fits in that category.
- moyix 13y agoYou don't need a preimage attack for SHA-1 to cause problems with CAs, just collisions. For example, MD5 does not have any preimage attacks I'm aware of, but it is possible to create rogue CA certificates that use MD5 [1]. Bruce Schneier estimates that we will see SHA-1 collisions relatively soon [2], so it's not like Microsoft is just making this stuff up. I agree that CA compromise is a serious problem, but it's not one Microsoft can do something about. They can ban SHA-1 in certificates, and I think it's a good idea. [1] http://www.phreedom.org/research/rogue-ca/ http://www.phreedom.org/research/rogue-ca/ [2] https://www.schneier.com/blog/archives/2012/10/when_will_we_se.html https://www.schneier.com/blog/archives/2012/10/when_will_we_...
- 0x0 13y agoDo they know something we don't about SHA1? It's not usual for Microsoft to be a first mover in cases like these, as far as I can remember? Also, is there a source on *.microsoft.com for this announcement?
- dmethvin 13y agohttp://technet.microsoft.com/en-us/security/advisory/2880823 http://technet.microsoft.com/en-us/security/advisory/2880823 http://blogs.technet.com/b/srd/archive/2013/11/12/security-advisory-2880823-recommendation-to-discontinue-use-of-sha-1.aspx?Redirected=true http://blogs.technet.com/b/srd/archive/2013/11/12/security-a...
- tptacek 13y agoProbably not. And, when it comes to crypto compatibility, there really is no such thing as "normal". It's all still early days.
- 0x0 13y agoJust noticed all four certs in the chain on https://www.microsoft.com https://www.microsoft.com use SHA1. The root cert, "Baltimore CyberTrust Root", expires in 2025. Will root CAs also have to be replaced by 2016? The relative urgency around this cutoff comes off as panick-y to me. They never seemed to bother updating roots or add SNI support for older, still supported OSes like WinXP.
- JohnTHaller 13y agoWindows XP is officially dead in 144 days, so they're likely unconcerned on that front.
- nullc 13y agoIf you can produce a collision against SHA-1 the Bitcoin network will pay you 2.47 BTC (which is worth about $1111 at the current market prices): https://bitcointalk.org/index.php?topic=293382.0 https://bitcointalk.org/index.php?topic=293382.0
- jluxenberg 13y ago>> We advise mining the block in which you collect your bounty yourself If you solve one of these, don't send the transaction to a miner for inclusion in the blockchain, or they'll steal your reward!
- 0x0 13y agoWithout joining a mining pool or broadcasting the transaction, wouldn't it be incredibly difficult to have a chance to successfully beat all the others and mine the block yourself? Or is the assumption that anyone who is able to solve the puzzle will also be able to mine any and all blocks instantly? And why couldn't you re-steal the award back again?
- davyjones 13y agoNot a question of 'if' but 'when'. It will happen at some point though unlikely in say, 1 or 2 years from now.
- nly 13y ago> Any certificate being used on the public web today which has an expiry date more than 3 years in the future will not be able to live out its full life. Why not have a later cut-off for certificates that were issued before, say, 1st January 2014? That way the CAs after January will know not to sign SHA-1 based certificates which will expire in or after 2016, but current long-life certificates (which aren't selfies anyway) will still be OK Also, microsoft.com seems to be using a certificate which uses MD5...
- Mindless2112 13y agoThe certificate I get for microsoft.com is "PKCS #1 SHA-1 With RSA Encryption" according to Firefox.
- nly 13y agoYou're right, I was looking at the cipher, I think. SSL_RSA_WITH_RC4_128_MD5
- JoachimS 13y agoThis is an interesting, good 'up the ante' (or follow up) from MS to Mozilla. Mozilla announced waay back at the end of 2010 that it will phase out support for certs using MD5 and 1024 bit keys: https://wiki.mozilla.org/CA:MD5and1024 https://wiki.mozilla.org/CA:MD5and1024 We are at the end of the phase out (last deadline is end of 2013) Mozilla will still accept SHA-1, but recommends against it. I would not be surprised however if Moz supported MS in their effort.
- nkvoll 13y agoI might have missed the obvious, but what are the currently suggested alternatives to SHA1?