3

I understand that most commercial browsers will stop trusting websites with SHA-1 PKI certificates by Jan 2017 so it is critical for websites to update to SHA-2 by that time. My question is, is it also critical for end-users to update their personal PKI certificates to SHA-2 by Jan 2017 to still be able to authenticate themselves to websites requiring certificate-based authentication? That is, will the browsers also stop supporting sending of SHA-1 certificates to websites during mutual authentication?

2 Answers 2

1

Web browsers will accept SHA-1 client authentication certificates. However, Web server may reject this certificate if authentication server (domain controller, for example) does not support SHA-1.

I think that most authentication servers will accept SHA-1 client certificates (at least Active Directory will do), because they are not subject of depreciation policy, but I would strongly recommend to upgrade your CAs to sign certificates with SHA-2.

5
  • Could you include some reference to support the answer? It's about future, so not easily verifiable now.
    – techraf
    Aug 5, 2016 at 6:31
  • For example, Microsoft's SHA-1 depreciation policy : aka.ms/sha1
    – Crypt32
    Aug 5, 2016 at 6:33
  • And which part exactly does prove (or even suggest) the client certificates with SHA-1 will be supported? I can see only TLS Certificates - 2/14/2017 - Windows trusts SHA-2 only under Schedule.
    – techraf
    Aug 5, 2016 at 6:39
  • Thanks. So for me, as an owner of a website that requires certificate based authentication, it is a MUST that I upgrade my site to serve SHA-2 certificate after 2016. If my web server is configured to accept SHA-1 client certificates, it is NOT required for my users to upgrade to SHA-2 client certificates even after 2016. So in a mutual authentication, it is possible for the server to serve a SHA-2 cert and accept a SHA-1 cert. Is that correct?
    – Raged
    Aug 5, 2016 at 6:43
  • This section: social.technet.microsoft.com/wiki/contents/articles/…
    – Crypt32
    Aug 5, 2016 at 9:48
-2

As far as I know, creating collisions for SHA1 hashes for certificates is theoretically possible but it still requires ~2^61 SHA compression (according to this paper from 2011). I don't know if there is more recent research on this topic with different results. The complexity of 2^61 means that only the most powerful players like NSA, etc. can produce a certificate that has the same hash as yours. If you are a high value target, then you should issue a new certificate but if you were you probably wouldn't have posted on this site.

2
  • 4
    That's not true. Collision attacks are not the same as pre-image attacks, and pre-image attacks are still infeasible against SHA1. (Although you still should be moving towards more secure hashes.)
    – Awn
    May 2, 2017 at 15:16
  • Preimage attacks are also infeasible against MD5, but you shouldn't be using it either!
    – forest
    Mar 29, 2018 at 0:55

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .