New answers tagged

5

Checking the root certificates of my browser I see that almost all Root CAs are using SHA-1 or below. The signing algorithm used for the trusted root certificates is unimportant. Signatures are used to establish trust. By definition, a trusted root certificate is one which you implicitly trust based on provenance (e.g., where it came from and how it ...


3

SHA-1, as a hash function, is known to be "slightly shaky". It is a 160-bit hash function (its output is a sequence of 160 bits); as such, it should offer 280 resistance to collisions, whereas it seems that its true resistance is closer to 261 or so. However, OAEP does not ask much from its underlying hash function. It seems that collision resistance is not ...


0

Not as a full answer, but for some additional overview information, including signtool example lines for dual signing (XP/Vista compatibility) I managed to switch nicely to dual-signing in my build chain according to this very good blog post from ksoftware.net, our certificate supplier. I wrote a small batch file to dual-sign a file with the two ...


0

I just went through the same issue with our Windows apps. So here's some info for you: A) As you pointed out SHA-1 hash is being phased out due to it's inadequate collision resistance. Or, in other words, it doesn't produce code signatures that are strong enough by today's crypto-standards. B) To code-sign your executable you'll need to have a code-signing ...


5

I've now found an example of an actual download that was signed using an SHA-1 certificate after 1/1/2016. I downloaded KeePass 2.31 using Edge on Windows 10. Edge tells me that "The signature of this file is corrupt or invalid." If I right-click and select "run anyway", our double-click the file in Windows Explorer, SmartScreen blocks the file: ...


0

Self-signed certificates with SHA-1 signature will continue to work in the sense that http traffic between client and server will continue to be encrypted. Browsers have always flagged self-signed certificates because the certificate has not been digitally signed by a trusted Certificate Authority. Starting in June 2016 Internet Explorer will now also flag ...


1

Microsoft announced a SHA-1 notice for their browsers starting in June 2016. The wording of the notice is still "under consideration". December, 2015 update: Microsoft is aware of recent advances in attacks on the SHA-1 algorithm and we are evaluating the impact of moving the dates on our schedule up further to help protect customers. The most ...


1

There are 3 digests in a timestamped Authenticode signature that you have control over. The digest of your certificate. A recently purchased certificate will use SHA-256. Most CAs switched to issuing SHA-256 certificates during 2014. They only provide SHA-1 certificates on special request. A quick way to check your certificate is to right-click on an ...


0

I donĀ“t think there will a restrinction on certificate path validation when they talk about this, but a restriction on CAs accepted on the public trusted root program. Those that use CA will not be accepted anymore, therefore wil be removed from the default installed ones in the system. You still would be able to add any CA you want on the trusted list ...



Top 50 recent answers are included