4 ms·

I think it's really crazy that certificates are now declared insecure based on their expiration date. We've deployed several certificates with a three year vali

I think it's really crazy that certificates are now declared insecure based on their expiration date. We've deployed several certificates with a three year validity (i.e. valid after 1-Jan-2017), and since our CA could only provide SHA-1, that's what we're using. Now these certificates get marked as insecure. However, if we'd gone for a 2 year validity, we'd be fine until somewhere in 2016. How does this help security? Why not have us replace these SHA-1 certificates somewhere in 2016?

lstamour 12y ago
You have to draw a line in the sand somewhere... And as mentioned elsewhere, you could keep using your SHA-1 certificate for older user agents while serving modern platforms a new, SHA-256 certificate in your name. Dropping SHA-1 in 2015 is better than doing so in 2016, after all. ;-)
giovannibajo1 12y ago
Because an attacker could get a copy of your certificate now, begin looking for a sha1 collision, and ride the Moore law until 2017; at any time they find a collision, they can begin MITM-ing your users. Have a look at the numbers linked in OP for an idea of the cost that is required to collide SHA1; news at 5pm: it's well within NSA wallet, and goes down and down very fast. So, deprecating a certificate on the basis of the issue date is a decision that makes to force people to start caring of the whole problem at the certain date, but then you would have people getting a 5 year SHA1 the day before the cutoff. Deprecating on the expiration date is the decision that better models the security risks.
- makomk 12y ago
  No they couldn't, because attacking a site's existing certificate in that way would require a preimage attack for SHA-1 which is much harder to achieve than a collision and unlikely to be feasable in the near future. In order to achieve a collision the attacker needs to control the contents of both certificates, which means they have to do all the computation and then somehow get a CA to issue a certificate with the exact contents they need. (This shouldn't be possible - after the MD5 attack a few years ago, CAs are expected to to take countermeasures to ensure an attacker doesn't have this level of control.)

lstamour 12y ago

You have to draw a line in the sand somewhere... And as mentioned elsewhere, you could keep using your SHA-1 certificate for older user agents while serving modern platforms a new, SHA-256 certificate in your name. Dropping SHA-1 in 2015 is better than doing so in 2016, after all. ;-)

giovannibajo1 12y ago

Because an attacker could get a copy of your certificate now, begin looking for a sha1 collision, and ride the Moore law until 2017; at any time they find a collision, they can begin MITM-ing your users. Have a look at the numbers linked in OP for an idea of the cost that is required to collide SHA1; news at 5pm: it's well within NSA wallet, and goes down and down very fast. So, deprecating a certificate on the basis of the issue date is a decision that makes to force people to start caring of the whole problem at the certain date, but then you would have people getting a 5 year SHA1 the day before the cutoff. Deprecating on the expiration date is the decision that better models the security risks.

makomk 12y ago
No they couldn't, because attacking a site's existing certificate in that way would require a preimage attack for SHA-1 which is much harder to achieve than a collision and unlikely to be feasable in the near future. In order to achieve a collision the attacker needs to control the contents of both certificates, which means they have to do all the computation and then somehow get a CA to issue a certificate with the exact contents they need. (This shouldn't be possible - after the MD5 attack a few years ago, CAs are expected to to take countermeasures to ensure an attacker doesn't have this level of control.)