Is using "SHA-256 with RSA-2048 Encryption" a secure certificate hashing algorithm? I don't think it is. Two examples: nsa.gov [careers site] give.wfp.org

  • 8
    Yes, this is the current standard.
    – Xander
    May 2 '16 at 20:44
  • 1
    What issues, exactly, do you think this scheme suffers from?
    – Polynomial
    May 2 '16 at 21:16
  • @Polynomial Security researchers recently cracked the NSA certificate and were able perform a MITM attack. May 4 '16 at 0:13
  • 1
    @JamesLu: Citation please? Nothing obvious in search results; they're all about the NSA doing MitM on Google using fraudulent certs, not about anybody breaking the NSA public key or certificate hash.
    – CBHacking
    May 4 '16 at 0:41
  • @CBHacking motherboard.vice.com/read/… Jul 18 '16 at 15:25

The technical answer is actually "no, because SHA-256 with RSA-2048 Encryption is not a certificate hashing algorithm. However, SHA-256 is a perfectly good secure hashing algorithm and quite suitable for use on certificates, and 2048-bit RSA is a good signing algorithm (signing is not the same as encrypting). Using 2048-bit RSA with SHA-256 is a secure signing scheme for a certificate. Why would you think otherwise?

SHA-256 is a member of the SHA2 family of secure hash functions, and there are not currently any cryptographic weaknesses publicly known for SHA2. It might be less secure than SHA-512, but 256 bits is already completely impractical to brute force (we're talking about timeframes of hundreds of years even with the resources of a nation-state and assuming Moore's Law continues on track, or billions of years for currently-established technology). The only viable attacks would require finding a weakness in the hash algorithm itself, and it's not necessarily the case that SHA-512 would be more resistant to such an attack than SHA-256. There is a new SHA3 standard, but it's not yet widely implemented so your browser probably wouldn't be able to verify the certificate's signature at all if they used SHA3 in the signing algorithm.

RSA is a current standard for public-key cryptography, and a properly-generated 2048-bit RSA key is strong enough to resist factoring for decades. You could use a 4096-bit key if you want to (it'll take a lot longer to generate, and slightly longer to use, but once the certificate's signature is verified that doesn't matter anymore), and that would take even longer to break. However, neither certificate is valid for more than two years anyhow. If you want a signature you can trust for 30 years or more, you might want to use something stronger than 2048-bit RSA, but for now that's fine.

  • See my above comment. May 4 '16 at 0:14
  • I'v seen many rainbow tables for SHA256. May 4 '16 at 0:15
  • 1
    A rainbow table for a hash function means literally nothing in terms of the security of the function. I could create a rainbow table for MD5 (cryptographically broken, also the shortest digest still in use) and for SHA3-512 (the longest-digest version of the brand-new successor to SHA2) with exactly the same amount of effort. The MD5 one would build faster and use less space, but not by huge factors in either case. They would be equally useless in creating forged certificates, though, because rainbow tables don't include anything close to the length of an X.509 certificate.
    – CBHacking
    May 4 '16 at 0:35
  • 1
    If you don't understand how the existence of a rainbow table is totally irrelevant to the security of a certificate signing scheme, I recommend you ask a new question about that. The short version, though, is that A) passwords and certificates are very different lengths, and B) most rainbow tables don't have collisions (much less collisions for an arbitrary specific digest) anyhow, and that's what you would need.
    – CBHacking
    May 4 '16 at 0:39
  • By "signing is not the same as encrypting", do you imply that 2048 bit key for RSA is not necessarily enough for encryption (for example, for PGP/SSH)? Oct 15 '17 at 18:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.