3 ms·
Microsoft only supports SHA-2 since Windows XP SP3 and Windows Server 2003 with a hotfix (which needs to be downloaded separately!). So ironically, Microsoft's
by praseodym 13y ago
Microsoft only supports SHA-2 since Windows XP SP3 and Windows Server 2003 with a hotfix (which needs to be downloaded separately!). So ironically, Microsoft's (old but still supported) products are the main reason that people are still generating SHA-1 certificates.
- AaronFriel 13y agoThe Windows Server 2003 hotfix addresses being able to receive and utilize an SHA-2 certificate, so unless you're suggesting the vast majority of webservers are WS2003, I'm guessing not. As for Windows XP, SP3 supports it without a hotfix, and SP3 has been out for 5 years, and it's currently the only supported branch of XP. Really the problem is just that the security industry moves very slowly, and when it does it lurches forward unpredictably because of the sudden release of a viable attack. As Microsoft suggests, a preimage attack could debilitate online security and would force a much more haphazard (and risky) move to new certificates. I expect >99% of web-browsing computers support SHA-2 these days, so there's no reason to allow the CA industry to continue limping along. So, ironically, it's Microsoft that will force the industry to move forward for once.
- yuhong 13y agoAnd as it happens, the Server 2003 hotfix required to support SHA256 certs and the XP/Server 2003 hotfix required for enrollment of SHA256 certificates (not that it matters as much as only the machine enrolling SHA256 certs needs it) are both included in MS13-095, because they stripped the GDR branch from new XP/Server 2003 updates ~6 months ago.