TE
TechEcho
Home24h TopNewestBestAskShowJobs
GitHubTwitter
Home

TechEcho

A tech news platform built with Next.js, providing global tech news and discussions.

GitHubTwitter

Home

HomeNewestBestAskShowJobs

Resources

HackerNews APIOriginal HackerNewsNext.js

© 2025 TechEcho. All rights reserved.

Why it’s harder to forge a SHA-1 certificate than to find a SHA-1 collision

180 pointsby thedgover 9 years ago

10 comments

agwaover 9 years ago
We&#x27;re lucky that hash collision attacks have a relatively simple mitigation like this. (Although you have to trust CAs to follow the rules and implement it properly, and events of the last few years indicate that CAs need to have as few things to screw up as possible.)<p>However, we&#x27;re not always going to be so lucky. The next major transition in digital certificates could very well be to post-quantum crypto due to advancements in quantum computing. Under that scenario, attackers will be able to simply compute a CA&#x27;s private key and sign arbitrary certificates. There will be no mitigation short of clients ceasing to trust pre-quantum certs. But clients won&#x27;t be able to do that unless servers are using post-quantum certs, and server operators won&#x27;t want to do that if it would mean cutting off legacy clients that don&#x27;t support post-quantum certs.<p>The solution to this first mover problem is to set a hard deadline after which legacy certs are retired. This forces clients and server operators to act. Pushing back the SHA-1 deadline at the 11th hour as CloudFlare proposes sends a dangerous message that such deadlines don&#x27;t have to be taken seriously. This message will come back to haunt the Internet in the future.
评论 #10780128 未加载
评论 #10781512 未加载
评论 #10782131 未加载
TazeTSchnitzelover 9 years ago
<p><pre><code> $ curl -s https:&#x2F;&#x2F;blog.cloudflare.com&#x2F;content&#x2F;images&#x2F;2015&#x2F;08&#x2F;white.jpg | md5 ccf22bc377846166ed65cd3cd58d2e3d $ curl -s https:&#x2F;&#x2F;blog.cloudflare.com&#x2F;content&#x2F;images&#x2F;2015&#x2F;08&#x2F;brown.jpg | md5 810cac197d97da7b216c7883be523495 $ curl -s https:&#x2F;&#x2F;blog.cloudflare.com&#x2F;content&#x2F;images&#x2F;2015&#x2F;08&#x2F;black.jpg | md5 6bede506abffe08d0c2406d92fbff393 </code></pre> Let me guess, the CloudFlare CDN is recompressing the images? :D
评论 #10779906 未加载
评论 #10779978 未加载
评论 #10779936 未加载
评论 #10779911 未加载
KirinDaveover 9 years ago
It&#x27;s worth noting that SHA1 is also suitable for use in HMAC on older hardware, security is not significantly compromised by SHA1&#x27;s properties.<p>You can move to more modern algorithms, but there isn&#x27;t a pressing need to remove SHA1 implementations for that application.
评论 #10780879 未加载
评论 #10779718 未加载
ben174over 9 years ago
Odd, I&#x27;m getting completely different MD5s from the three example images.<p><pre><code> ~ curl -s https:&#x2F;&#x2F;blog.cloudflare.com&#x2F;content&#x2F;images&#x2F;2015&#x2F;08&#x2F;white.jpg | md5</code></pre> ccf22bc377846166ed65cd3cd58d2e3d<p><pre><code> ~ curl -s https:&#x2F;&#x2F;blog.cloudflare.com&#x2F;content&#x2F;images&#x2F;2015&#x2F;08&#x2F;brown.jpg | md5</code></pre> 810cac197d97da7b216c7883be523495<p><pre><code> ~ curl -s https:&#x2F;&#x2F;blog.cloudflare.com&#x2F;content&#x2F;images&#x2F;2015&#x2F;08&#x2F;black.jpg | md5</code></pre> 6bede506abffe08d0c2406d92fbff393
评论 #10780017 未加载
viraptorover 9 years ago
I don&#x27;t get the issue with serial numbers. For the browser, it&#x27;s a completely opaque random number - it doesn&#x27;t matter what it is and how it changes.<p>Is the issue here that they&#x27;re talking about CA collisions and need the &quot;authority key identifier&quot; extension to match? This shouldn&#x27;t matter when colliding with service certificates.
ademarreover 9 years ago
Nice write-up, but it&#x27;s slightly misleading or confusing to not explain that Nat McHugh&#x27;s image collisions were chosen-prefix attacks. The post makes it sound like the images were the product of some unexplained collision, and then goes on to explain how chosen prefix can be used to forge certificates.
评论 #10780029 未加载
kazinatorover 9 years ago
Let me guess: birthday paradox? It&#x27;s harder to find someone in the room who has the same birthday as you, than to find a pair of people who have the same birthday.
bracewelover 9 years ago
Guh, until CF&#x2F;FB can provide some data that shows users with no upgrade path are genuinely going to be effected by this, and not connections MITM&#x27;d by some crappy AV or other random middlebox the LV proposal seems like a pretty silly idea...<p><a href="https:&#x2F;&#x2F;www.cabforum.org&#x2F;pipermail&#x2F;public&#x2F;2015-December&#x2F;006495.html" rel="nofollow">https:&#x2F;&#x2F;www.cabforum.org&#x2F;pipermail&#x2F;public&#x2F;2015-December&#x2F;0064...</a>
评论 #10779944 未加载
评论 #10781498 未加载
评论 #10781539 未加载
yuhongover 9 years ago
I was proposing restricting to manual issuance of OV certs given that automated issuance is the source of most attacks.
leereevesover 9 years ago
Can an attacker bypass this by using the serial number and validity period from an already issued certificate?