Microsoft ‘Mortally Wounds’ SHA-1

http://blog.gerv.net/2013/11/microsoft-mortally-wounds-sha-1/

by andrewaylett • 13 years ago

105 67 13 years ago

blog.gerv.net

I'm in two minds about this: it's great that we're going to be able to move forward, but I'm not sure about one organisation having the power to unilaterally dictate to everyone and expect people to listen to them.

Also, I imagine that people are still generating SHA-1 certs out of a (possibly misguided) sense of remaining compatible with old devices. Anyone know what impact this might have?

praseodym• 13 years ago

Microsoft only supports SHA-2 since Windows XP SP3 and Windows Server 2003 with a hotfix (which needs to be downloaded separately!). So ironically, Microsoft's (old but still supported) products are the main reason that people are still generating SHA-1 certificates.

AaronFriel• 13 years ago

The Windows Server 2003 hotfix addresses being able to receive and utilize an SHA-2 certificate, so unless you're suggesting the vast majority of webservers are WS2003, I'm guessing not. As for Windows XP, SP3 supports it without a hotfix, and SP3 has been out for 5 years, and it's currently the only supported branch of XP.

Really the problem is just that the security industry moves very slowly, and when it does it lurches forward unpredictably because of the sudden release of a viable attack. As Microsoft suggests, a preimage attack could debilitate online security and would force a much more haphazard (and risky) move to new certificates. I expect >99% of web-browsing computers support SHA-2 these days, so there's no reason to allow the CA industry to continue limping along.

So, ironically, it's Microsoft that will force the industry to move forward for once.

jamra3• 13 years ago

Killing off weak encryption is absolutely necessary. Sha-1 is hard-coded into their RSA implementation in the dotnet library.

Without doing this in a total way, they wouldn't be able to do it at all. Now all the internal Microsoft fiefdoms will have to comply.

Pxtl• 13 years ago

Seriously? I don't do much encryption, but which .NET framework lib still uses Sha-1?

Of course, this is one of those cases where I'd imagine that MS's approach to protecting backwards compat will mean nothing but a warning thrown when you reference the old lib, and any new libraries sport a completely different API making them unsuitable as a drop-in replacement. MS protects compatibility religiously while simultaneously applying a Not Invented Here mentality to code that actually was Invented Here.

Locke16892• 13 years ago

This is not true.

http://msdn.microsoft.com/en-us/library/9tsc5d0z(v=vs.110).a...

The second parameter is the digest algorithm.

forgottenpass2• 13 years ago

but I'm not sure about one organisation having the power to unilaterally dictate to everyone and expect people to listen to them.

Isn't revving SHA kind of a triviality compared to all the other things Microsoft and other big guys use their market position to force through?

andrewaylett2• 13 years ago

It's the 'expect people to listen to them' bit that I'm less sure of. Most of the other things you're referring to are rather more obviously purely for the benefit of the instigator, and they can compel people to listen.

In this case, the change should actually benefit the community. Again, they can compel people to listen but I sort of get the impression that they're expecting people to be happy about the change. Indeed, I'm not going to complain too loudly especially as none of my certificates have a far enough out expiry to be affected.

I suppose my point is that even if you think everyone will be pleased at a change you're making, if you want people to be happy you should probably check with them before acting.

yesiamyourdad• 13 years ago

"one organisation having the power to unilaterally dictate to everyone and expect people to listen to them"

In tech frequently a benevolent dictatorship is the only way to get things done. They could take this through the IETF or ICANN or something but they'd spend 5 years listening to people prattle on about edge cases while SHA-1 becomes progressively less secure. I worked with airlines for a number of years and the amount of effort spent trying to keep old devices alive on their networks FAR exceeds what it would've cost to just upgrade the devices.

salient• 13 years ago

Now how about you "mortally wound" Skype's (in)security model, Microsoft?

No end-to-end security = no security.

peterwwillis• 13 years ago

Error establishing a database connection

STOP REQUIRING DATABASE CONNECTIONS TO SERVE STATIC CONTENT!

forgottenpass2• 13 years ago

Everything is going to be OK.

lstamour• 13 years ago

I just used a google cache: http://webcache.googleusercontent.com/search?q=cache:Mv3YNrj...

kzrdude• 13 years ago

Is Intel still going to add SHA-1 specific instructions to their next chip? I'm hoping for that to be reversed.

api3• 13 years ago

AES-specific instructions were even a bit questionable... but this is highly questionable. Algorithm-specific instructions are basically going to become very dated cruft within a few years to a decade tops and are probably a bad thing to add to any instruction set. Better would be to add instructions for speeding up all sorts of crypto algorithms.

steve19• 13 years ago

They can just implement cruft in microcode rather than silicon. In the meantime everyone using AES for full disk encryption gets a nice speedup.

geofft3• 13 years ago

AES-specific instructions are also the only sane way to implement AES without timing attacks.

I'm curious about this "instructions for speeding up all sorts of crypto algorithms" proposal -- how would you do that, given that crypto algorithms tend to have a wide variety of implementations and a wide variety of mathematical underpinnings? Do you want instructions that speed up all sorts of math?

jevinskie• 13 years ago

AES-NI instructions have their own bit in CPUID (not bundled with any SSE bit) so future chips could not include it and software would fall back to regular AES code paths.

aetherson2• 13 years ago

Is that 98% of all internet certificates use SHA-1 statistic true?

moyix2• 13 years ago

According to this EFF presentation [1] (slide 24) where they scanned the internet for SSL servers in 2010, it's actually an underestimate -- in fact around 99.995% of servers use SHA1. The query shown only considers certs created in 2010, though; I'm grabbing the data set to verify now, but I suspect that 98% is not unreasonable.

Edit: Here's the full data. ~99%:

  mysql> SELECT `Signature Algorithm`, count(*) FROM valid_certs GROUP BY `Signature Algorithm`;
  +--------------------------+----------+
  | Signature Algorithm      | count(*) |
  +--------------------------+----------+
  |  md2WithRSAEncryption    |        4 |
  |  md5WithRSAEncryption    |    13942 |
  |  sha1WithRSA             |        3 |
  |  sha1WithRSAEncryption   |  1441335 |
  |  sha256WithRSAEncryption |      106 |
  |  sha512WithRSAEncryption |        1 |
  +--------------------------+----------+

[1] https://www.eff.org/files/ccc2010.pdf

aetherson2• 13 years ago

Jesus. Thanks for the data!

ben0x539• 13 years ago

I hope all my sha-1 hashed git commit ids are gonna be okay. :(

mackal• 13 years ago

Unless you are trying to make a joke with the title of the post, sha-1 not related to certificates will be unaffected.

graue• 13 years ago

Unaffected by Microsoft's announcement, yes. However, they will be affected by any successful preimage [edit: or collision] attacks on SHA-1, and the possibility of such an attack appears to motivate Microsoft's announcement.

api3• 13 years ago

Even if SHA-1 were weakened considerably, this would not impact this particular use case all that much... except in cases where git hashes are used in a security-critical way. (Which is probably not that great an idea...)

MichaelGG• 13 years ago

Doesn't a signed git tag rely on signing the 160-bit hash? So if SHA-1 was really weakened, you could reuse a signature by generating a repo that hashes to the same value as the signed one?

csense• 13 years ago

git hashes are used in a security-critical way

Verifying the integrity of the source code of e.g. the Linux kernel is pretty security-critical.

taf2• 13 years ago

I'm cool with their change if they also auto upgrade all WinXP users.

justin66• 13 years ago

Windows XP users will have been without support for a couple of years before this becomes relevant. Extended support for XP ends on April 8, 2014.

yuhong3• 13 years ago

XP SP3 already have support.

JohnTHaller3• 13 years ago

Windows XP already has support via a hotfix. Windows XP dies in 144 days, anyway, so anyone left using it by the time this takes effect will be using a hopelessly insecure system for some time already.

dontmakemelaugh• 13 years ago

it won't die. it will be used for years by millions of users. that some company stops issuing security updates for a software means nothing to most users. it probably will even make them more happy because they are not nagged by update messages all the time.

ck2• 13 years ago

Shouldn't the title be "Microsoft ‘Mortally Wounds’ Windows" ?

I mean it is only windows affected.

And I bet browsers other than IE will work.

geofft3• 13 years ago

Yes, website operators that don't have any Windows users they care about aren't affected. All three of them.

Somewhat more relevantly, CAs that don't have any customers who have any Windows users they care about aren't affected. That's probably closer to zero.

api3• 13 years ago

Personally I think the risk that CAs are or will be compromised is much higher than the risk of a practical SHA-1 preimage attack. The entire CA model is very shaky.

MS has a history of helping out its buddies in the certificate troll mafia. This seems like it kind of fits in that category.

moyix2• 13 years ago

You don't need a preimage attack for SHA-1 to cause problems with CAs, just collisions. For example, MD5 does not have any preimage attacks I'm aware of, but it is possible to create rogue CA certificates that use MD5 [1]. Bruce Schneier estimates that we will see SHA-1 collisions relatively soon [2], so it's not like Microsoft is just making this stuff up.

I agree that CA compromise is a serious problem, but it's not one Microsoft can do something about. They can ban SHA-1 in certificates, and I think it's a good idea.

[1] http://www.phreedom.org/research/rogue-ca/

[2] https://www.schneier.com/blog/archives/2012/10/when_will_we_...

0x03• 13 years ago

Do they know something we don't about SHA1?

It's not usual for Microsoft to be a first mover in cases like these, as far as I can remember?

Also, is there a source on *.microsoft.com for this announcement?

dmethvin• 13 years ago

http://technet.microsoft.com/en-us/security/advisory/2880823

http://blogs.technet.com/b/srd/archive/2013/11/12/security-a...

tptacek6• 13 years ago

Probably not. And, when it comes to crypto compatibility, there really is no such thing as "normal". It's all still early days.

0x03• 13 years ago

Just noticed all four certs in the chain on https://www.microsoft.com use SHA1. The root cert, "Baltimore CyberTrust Root", expires in 2025. Will root CAs also have to be replaced by 2016?

The relative urgency around this cutoff comes off as panick-y to me. They never seemed to bother updating roots or add SNI support for older, still supported OSes like WinXP.

nullc• 13 years ago

If you can produce a collision against SHA-1 the Bitcoin network will pay you 2.47 BTC (which is worth about $1111 at the current market prices): https://bitcointalk.org/index.php?topic=293382.0

jluxenberg• 13 years ago

> We advise mining the block in which you collect your bounty yourself

If you solve one of these, don't send the transaction to a miner for inclusion in the blockchain, or they'll steal your reward!

0x03• 13 years ago

Without joining a mining pool or broadcasting the transaction, wouldn't it be incredibly difficult to have a chance to successfully beat all the others and mine the block yourself?

Or is the assumption that anyone who is able to solve the puzzle will also be able to mine any and all blocks instantly?

And why couldn't you re-steal the award back again?

davyjones• 13 years ago

Not a question of 'if' but 'when'. It will happen at some point though unlikely in say, 1 or 2 years from now.

nly2• 13 years ago

Any certificate being used on the public web today which has an expiry date more than 3 years in the future will not be able to live out its full life.

Why not have a later cut-off for certificates that were issued before, say, 1st January 2014? That way the CAs after January will know not to sign SHA-1 based certificates which will expire in or after 2016, but current long-life certificates (which aren't selfies anyway) will still be OK

Also, microsoft.com seems to be using a certificate which uses MD5...

Mindless2112• 13 years ago

The certificate I get for microsoft.com is "PKCS #1 SHA-1 With RSA Encryption" according to Firefox.

nly2• 13 years ago

You're right, I was looking at the cipher, I think. SSL_RSA_WITH_RC4_128_MD5

JoachimS• 13 years ago

This is an interesting, good 'up the ante' (or follow up) from MS to Mozilla.

Mozilla announced waay back at the end of 2010 that it will phase out support for certs using MD5 and 1024 bit keys:

https://wiki.mozilla.org/CA:MD5and1024

We are at the end of the phase out (last deadline is end of 2013) Mozilla will still accept SHA-1, but recommends against it. I would not be surprised however if Moz supported MS in their effort.

nkvoll• 13 years ago

I might have missed the obvious, but what are the currently suggested alternatives to SHA1?

Microsoft ‘Mortally Wounds’ SHA-1

Related Stories