3 ms·
Because an attacker could get a copy of your certificate now, begin looking for a sha1 collision, and ride the Moore law until 2017; at any time they find a col
by giovannibajo1 12y ago
Because an attacker could get a copy of your certificate now, begin looking for a sha1 collision, and ride the Moore law until 2017; at any time they find a collision, they can begin MITM-ing your users. Have a look at the numbers linked in OP for an idea of the cost that is required to collide SHA1; news at 5pm: it's well within NSA wallet, and goes down and down very fast.
So, deprecating a certificate on the basis of the issue date is a decision that makes to force people to start caring of the whole problem at the certain date, but then you would have people getting a 5 year SHA1 the day before the cutoff. Deprecating on the expiration date is the decision that better models the security risks.
- makomk 12y agoNo they couldn't, because attacking a site's existing certificate in that way would require a preimage attack for SHA-1 which is much harder to achieve than a collision and unlikely to be feasable in the near future. In order to achieve a collision the attacker needs to control the contents of both certificates, which means they have to do all the computation and then somehow get a CA to issue a certificate with the exact contents they need. (This shouldn't be possible - after the MD5 attack a few years ago, CAs are expected to to take countermeasures to ensure an attacker doesn't have this level of control.)