SHA1 is broken

[dark_moon]

https://security.googleblog.com/2017/02 ... ision.html
https://www.reddit.com/r/netsec/comment ... collision/

I create a PDF from the news on googleblog. Just the site goes offline...

SHA1_collision.pdf

(268.08 KiB) Downloaded 49 times

[tuxman]

Sadly, OpenPGP, iOS and similar software still rely on SHA-1. Those are interesting times for pentesters.

[dark_moon]

Yeah. Hope they change that then.

Also here a short summary: http://borncity.com/win/2017/02/24/warn ... cessfully/

[Moonchild]

SHA1 has been known to be weak for pure encryption/signing purposes. This is exactly why SHA1 certificates for secure websites have been phased out.
It is however NOT an issue for other purposes where collisions aren't a concern.

So, for the people who might panic:
SHA1 certificates for encryption shouldn't be used. This has been known for years and the Internet as a whole has migrated to SHA256.
Anyone using PGP for mail encryption should also have long since been migrated to SHA256.
SHA1 as part of an SSL/TLS cipher suite is not a problem, because the hash there is merely the HMAC^[1]

[1]

Security
The cryptographic strength of the HMAC depends upon the size of the secret key that is used. The most common attack against HMACs is brute force to uncover the secret key. HMACs are substantially less affected by collisions than their underlying hashing algorithms alone.[6][7][8] Therefore, HMAC-MD5 does not suffer from the same weaknesses that have been found in MD5.

[dark_moon]

Thanks for that info, Moonchild

[GreenGeek]

I'm inferring from what I read elsewhere as well as MoonChild's post that "sha" (without 256) in the cyphersuite name refers to SHA-1. If all those were bad, we wouldn't have many left. So, yea, thanks Moonchild.

[dark_moon]

I found here a nice overview of hash lifetimes:
http://valerieaurora.org/hash.html

[Moonchild]

I'm inferring from what I read elsewhere as well as MoonChild's post that "sha" (without 256) in the cyphersuite name refers to SHA-1. If all those were bad, we wouldn't have many left. So, yea, thanks Moonchild.

SHA without a number in a ciphersuite is indeed SHA-1 HMAC.

[oTPS0]

I found here a nice overview of hash lifetimes:
http://valerieaurora.org/hash.html

Fantastic link find!

Thanks!