4 ms·

I'm in two minds about this: it's great that we're going to be able to move forward, but I'm not sure about one organisation having the power to unilaterally di

I'm in two minds about this: it's great that we're going to be able to move forward, but I'm not sure about one organisation having the power to unilaterally dictate to everyone and expect people to listen to them. Also, I imagine that people are still generating SHA-1 certs out of a (possibly misguided) sense of remaining compatible with old devices. Anyone know what impact this might have?

praseodym 13y ago
Microsoft only supports SHA-2 since Windows XP SP3 and Windows Server 2003 with a hotfix (which needs to be downloaded separately!). So ironically, Microsoft's (old but still supported) products are the main reason that people are still generating SHA-1 certificates.
- AaronFriel 13y ago
  The Windows Server 2003 hotfix addresses being able to receive and utilize an SHA-2 certificate, so unless you're suggesting the vast majority of webservers are WS2003, I'm guessing not. As for Windows XP, SP3 supports it without a hotfix, and SP3 has been out for 5 years, and it's currently the only supported branch of XP. Really the problem is just that the security industry moves very slowly, and when it does it lurches forward unpredictably because of the sudden release of a viable attack. As Microsoft suggests, a preimage attack could debilitate online security and would force a much more haphazard (and risky) move to new certificates. I expect >99% of web-browsing computers support SHA-2 these days, so there's no reason to allow the CA industry to continue limping along. So, ironically, it's Microsoft that will force the industry to move forward for once.
  - yuhong 13y ago
    And as it happens, the Server 2003 hotfix required to support SHA256 certs and the XP/Server 2003 hotfix required for enrollment of SHA256 certificates (not that it matters as much as only the machine enrolling SHA256 certs needs it) are both included in MS13-095, because they stripped the GDR branch from new XP/Server 2003 updates ~6 months ago.
jamra 13y ago
Killing off weak encryption is absolutely necessary. Sha-1 is hard-coded into their RSA implementation in the dotnet library. Without doing this in a total way, they wouldn't be able to do it at all. Now all the internal Microsoft fiefdoms will have to comply.
- Pxtl 13y ago
  Seriously? I don't do much encryption, but which .NET framework lib still uses Sha-1? Of course, this is one of those cases where I'd imagine that MS's approach to protecting backwards compat will mean nothing but a warning thrown when you reference the old lib, and any new libraries sport a completely different API making them unsuitable as a drop-in replacement. MS protects compatibility religiously while simultaneously applying a Not Invented Here mentality to code that actually was Invented Here.
  - jamra 13y ago
    RSACryptoServiceProvider uses Sha-1. It does not ask for a hash function. I learned this recently while trying to port over a client C# program to Golang.
- Locke1689 13y ago
  This is not true. http://msdn.microsoft.com/en-us/library/9tsc5d0z(v=vs.110).aspx http://msdn.microsoft.com/en-us/library/9tsc5d0z(v=vs.110).a... The second parameter is the digest algorithm.
  - jamra 13y ago
    That's if you sign the data. If you just run Decrypt, it does not ask for a hash function. Under the hood, it uses Sha-1. Edit: Here is a link to the golang implementation http://golang.org/pkg/crypto/rsa/#DecryptOAEP http://golang.org/pkg/crypto/rsa/#DecryptOAEP It takes a hash as the first param Here is the C# counterpart http://msdn.microsoft.com/en-us/library/system.security.cryptography.rsa.decryptvalue(v=vs.110).aspx http://msdn.microsoft.com/en-us/library/system.security.cryp... It does not take in a hash function though I believe you can modify how it works although I never tried to. I wasn't referring to explicitly signing the data.
forgottenpass 13y ago
but I'm not sure about one organisation having the power to unilaterally dictate to everyone and expect people to listen to them. Isn't revving SHA kind of a triviality compared to all the other things Microsoft and other big guys use their market position to force through?
- andrewaylett 13y ago
  It's the 'expect people to listen to them' bit that I'm less sure of. Most of the other things you're referring to are rather more obviously purely for the benefit of the instigator, and they can compel people to listen. In this case, the change should actually benefit the community. Again, they can compel people to listen but I sort of get the impression that they're expecting people to be happy about the change. Indeed, I'm not going to complain too loudly especially as none of my certificates have a far enough out expiry to be affected. I suppose my point is that even if you think everyone will be pleased at a change you're making, if you want people to be happy you should probably check with them before acting.
yesiamyourdad 13y ago
"one organisation having the power to unilaterally dictate to everyone and expect people to listen to them" In tech frequently a benevolent dictatorship is the only way to get things done. They could take this through the IETF or ICANN or something but they'd spend 5 years listening to people prattle on about edge cases while SHA-1 becomes progressively less secure. I worked with airlines for a number of years and the amount of effort spent trying to keep old devices alive on their networks FAR exceeds what it would've cost to just upgrade the devices.

praseodym 13y ago

Microsoft only supports SHA-2 since Windows XP SP3 and Windows Server 2003 with a hotfix (which needs to be downloaded separately!). So ironically, Microsoft's (old but still supported) products are the main reason that people are still generating SHA-1 certificates.

AaronFriel 13y ago
The Windows Server 2003 hotfix addresses being able to receive and utilize an SHA-2 certificate, so unless you're suggesting the vast majority of webservers are WS2003, I'm guessing not. As for Windows XP, SP3 supports it without a hotfix, and SP3 has been out for 5 years, and it's currently the only supported branch of XP. Really the problem is just that the security industry moves very slowly, and when it does it lurches forward unpredictably because of the sudden release of a viable attack. As Microsoft suggests, a preimage attack could debilitate online security and would force a much more haphazard (and risky) move to new certificates. I expect >99% of web-browsing computers support SHA-2 these days, so there's no reason to allow the CA industry to continue limping along. So, ironically, it's Microsoft that will force the industry to move forward for once.
- yuhong 13y ago
  And as it happens, the Server 2003 hotfix required to support SHA256 certs and the XP/Server 2003 hotfix required for enrollment of SHA256 certificates (not that it matters as much as only the machine enrolling SHA256 certs needs it) are both included in MS13-095, because they stripped the GDR branch from new XP/Server 2003 updates ~6 months ago.

jamra 13y ago

Killing off weak encryption is absolutely necessary. Sha-1 is hard-coded into their RSA implementation in the dotnet library. Without doing this in a total way, they wouldn't be able to do it at all. Now all the internal Microsoft fiefdoms will have to comply.

Pxtl 13y ago
Seriously? I don't do much encryption, but which .NET framework lib still uses Sha-1? Of course, this is one of those cases where I'd imagine that MS's approach to protecting backwards compat will mean nothing but a warning thrown when you reference the old lib, and any new libraries sport a completely different API making them unsuitable as a drop-in replacement. MS protects compatibility religiously while simultaneously applying a Not Invented Here mentality to code that actually was Invented Here.
- jamra 13y ago
  RSACryptoServiceProvider uses Sha-1. It does not ask for a hash function. I learned this recently while trying to port over a client C# program to Golang.
Locke1689 13y ago
This is not true. http://msdn.microsoft.com/en-us/library/9tsc5d0z(v=vs.110).aspx http://msdn.microsoft.com/en-us/library/9tsc5d0z(v=vs.110).a... The second parameter is the digest algorithm.
- jamra 13y ago
  That's if you sign the data. If you just run Decrypt, it does not ask for a hash function. Under the hood, it uses Sha-1. Edit: Here is a link to the golang implementation http://golang.org/pkg/crypto/rsa/#DecryptOAEP http://golang.org/pkg/crypto/rsa/#DecryptOAEP It takes a hash as the first param Here is the C# counterpart http://msdn.microsoft.com/en-us/library/system.security.cryptography.rsa.decryptvalue(v=vs.110).aspx http://msdn.microsoft.com/en-us/library/system.security.cryp... It does not take in a hash function though I believe you can modify how it works although I never tried to. I wasn't referring to explicitly signing the data.

forgottenpass 13y ago

but I'm not sure about one organisation having the power to unilaterally dictate to everyone and expect people to listen to them. Isn't revving SHA kind of a triviality compared to all the other things Microsoft and other big guys use their market position to force through?

andrewaylett 13y ago
It's the 'expect people to listen to them' bit that I'm less sure of. Most of the other things you're referring to are rather more obviously purely for the benefit of the instigator, and they can compel people to listen. In this case, the change should actually benefit the community. Again, they can compel people to listen but I sort of get the impression that they're expecting people to be happy about the change. Indeed, I'm not going to complain too loudly especially as none of my certificates have a far enough out expiry to be affected. I suppose my point is that even if you think everyone will be pleased at a change you're making, if you want people to be happy you should probably check with them before acting.

yesiamyourdad 13y ago

"one organisation having the power to unilaterally dictate to everyone and expect people to listen to them" In tech frequently a benevolent dictatorship is the only way to get things done. They could take this through the IETF or ICANN or something but they'd spend 5 years listening to people prattle on about edge cases while SHA-1 becomes progressively less secure. I worked with airlines for a number of years and the amount of effort spent trying to keep old devices alive on their networks FAR exceeds what it would've cost to just upgrade the devices.