8

Is using "SHA-256 with RSA-2048 Encryption" a secure certificate hashing algorithm? I don't think it is. Two examples: nsa.gov [careers site] give.wfp.org

Improve this question
6
  • 9
    Yes, this is the current standard.
    – Xander
    May 2, 2016 at 20:44
  • 1
    What issues, exactly, do you think this scheme suffers from?
    – Polynomial
    May 2, 2016 at 21:16
  • @Polynomial Security researchers recently cracked the NSA certificate and were able perform a MITM attack.
    – noɥʇʎԀʎzɐɹƆ
    May 4, 2016 at 0:13
  • 1
    @JamesLu: Citation please? Nothing obvious in search results; they're all about the NSA doing MitM on Google using fraudulent certs, not about anybody breaking the NSA public key or certificate hash.
    – CBHacking
    May 4, 2016 at 0:41
  • @CBHacking motherboard.vice.com/read/…
    – noɥʇʎԀʎzɐɹƆ
    Jul 18, 2016 at 15:25

2 Answers 2

Reset to default
19

The technical answer is actually "no, because SHA-256 with RSA-2048 Encryption is not a certificate hashing algorithm. However, SHA-256 is a perfectly good secure hashing algorithm and quite suitable for use on certificates, and 2048-bit RSA is a good signing algorithm (signing is not the same as encrypting). Using 2048-bit RSA with SHA-256 is a secure signing scheme for a certificate. Why would you think otherwise?

SHA-256 is a member of the SHA2 family of secure hash functions, and there are not currently any cryptographic weaknesses publicly known for SHA2. It might be less secure than SHA-512, but 256 bits is already completely impractical to brute force (we're talking about timeframes of hundreds of years even with the resources of a nation-state and assuming Moore's Law continues on track, or billions of years for currently-established technology). The only viable attacks would require finding a weakness in the hash algorithm itself, and it's not necessarily the case that SHA-512 would be more resistant to such an attack than SHA-256. There is a new SHA3 standard, but it's not yet widely implemented so your browser probably wouldn't be able to verify the certificate's signature at all if they used SHA3 in the signing algorithm.

RSA is a current standard for public-key cryptography, and a properly-generated 2048-bit RSA key is strong enough to resist factoring for decades. You could use a 4096-bit key if you want to (it'll take a lot longer to generate, and slightly longer to use, but once the certificate's signature is verified that doesn't matter anymore), and that would take even longer to break. However, neither certificate is valid for more than two years anyhow. If you want a signature you can trust for 30 years or more, you might want to use something stronger than 2048-bit RSA, but for now that's fine.

Improve this answer
10
  • See my above comment.
    – noɥʇʎԀʎzɐɹƆ
    May 4, 2016 at 0:14
  • I'v seen many rainbow tables for SHA256.
    – noɥʇʎԀʎzɐɹƆ
    May 4, 2016 at 0:15
  • 2
    A rainbow table for a hash function means literally nothing in terms of the security of the function. I could create a rainbow table for MD5 (cryptographically broken, also the shortest digest still in use) and for SHA3-512 (the longest-digest version of the brand-new successor to SHA2) with exactly the same amount of effort. The MD5 one would build faster and use less space, but not by huge factors in either case. They would be equally useless in creating forged certificates, though, because rainbow tables don't include anything close to the length of an X.509 certificate.
    – CBHacking
    May 4, 2016 at 0:35
  • 1
    If you don't understand how the existence of a rainbow table is totally irrelevant to the security of a certificate signing scheme, I recommend you ask a new question about that. The short version, though, is that A) passwords and certificates are very different lengths, and B) most rainbow tables don't have collisions (much less collisions for an arbitrary specific digest) anyhow, and that's what you would need.
    – CBHacking
    May 4, 2016 at 0:39
  • By "signing is not the same as encrypting", do you imply that 2048 bit key for RSA is not necessarily enough for encryption (for example, for PGP/SSH)?
    – Franklin Yu
    Oct 15, 2017 at 18:37
0

Researcher Claims to Crack RSA-2048 With Quantum Computer https://www.bankinfosecurity.com/blogs/researcher-claims-to-crack-rsa-2048-quantum-computer-p-3536

Improve this answer
2
  • 2
    While this link may answer the question, it is better to include the essential parts of the answer here and provide the link for reference. Link-only answers can become invalid if the linked page changes. - From Review
    – Chenmunka
    Nov 3 at 21:52
  • The author if sha-256 is safe - I answer that even sha-512 not safe anymore. It is a tme to go post quantum cryptography
    – user2347380
    Nov 4 at 22:04

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .