Today Google announced the first SHA-1 collision, and they will release a PoC which is public accessible 90 days later. Here comes the question: should we only use TLSv1.2 since version below 1.2 support SHA-1, proofed not secure, but dont support SHA-2.

  • 2
    The weakness outlined in the paper does not affect TLS. If you have the capability to require TLS 1.2 for your application, by all means, do so. However, you're no less safe after this particularly attack than you were before it.
    – Xander
    Feb 23 '17 at 20:50
  • If you turn off 1.1 or 1.0, you'll lose customers and money (if a non-private network/application or course) Feb 23 '17 at 21:40
  • @NeilMcGuigan Can you explain more? Many modern browser/client support 1.2 already, why "lose customers and money"?
    – Hartman
    Feb 23 '17 at 21:45
  • Yes, "many" but not all. There are millions and millions of desktops with IE < 11.0 Feb 23 '17 at 21:48
  • So, compatibility and security, which one should go first?
    – Hartman
    Feb 23 '17 at 22:01

TLS (and SSL) used or uses SHA-1 in three ways.

  • 1.0 and 1.1 used HMAC-SHA1 for data integrity in nearly all ciphersuites (a few old ones used HMAC-MD5 but they have mostly fallen by the wayside already). 1.2 adds some new ciphersuites that use HMAC-SHA2 (SHA-256 or SHA-384) and some new ciphersuites that use AEAD which combines integrity into the encryption (specifically AES or some others with GCM, AES with CCM, and ChaCha20-Poly13505; in practice only AES-GCM and ChaCha are common).

    The HMAC construction blocks collision attacks like the new one for SHA1. Ciphersuites using HMAC-SHA1 remain as secure now as they were before, and as secure as HMAC-SHA2 -- which is, not entirely, because there already were and still are attacks unrelated to the hash. Specifically, all HMAC ciphersuites either use RC4, which is badly weakened and now prohibited from all vesions of TLS, or CBC-mode ciphers with MAC-then-encrypt, which have been subject to a series of padding-oracle attacks -- and in 1.0 also a known-IV attack (BEAST). The fix to these attacks is to use AEAD ciphersuites (with neither HMAC-SHA1 nor HMAC-SHA2), which requires 1.2. "SHAttered" makes no difference. You should already have preferred 1.2 with AEAD not HMAC-SHA1 OR HMAC-SHA2, and you should still.

  • PRF and key derivation. 1.0 and 1.1 used a combination of double-HMAC-MD5 and double-HMAC-SHA1 for the PRF used in the handshake for key derivation and Finished; 1.2 uses double-HMAC-SHA2. As above HMAC protects against the collision attack, plus the key derivation and Finished data are substantially uncontrollable by an attacker anyway. No difference.

  • Certificates. TLS, including 1.2, usually (though not quite always) relies on certificates and their signatures, and collision attack can endanger certificate signatures in at least some cases. This was true for MD5 with the 'rogue' attack a decade ago, and resulted in fairly rapid retirement of MD5 certificates. The community has recognized for years that SHA1 certificates were similarly at risk: CAs have been forbidden to issue SHA1-signed certificates for at least 2 years, depending which authority you go by, and some (most?) browsers, some other clients and servers, and many tools (notably SSLLabs widely used tester) have been warning more or less noisily and intrusively about SHA1-signed certs for a least a year; now, as the shattered website notes, some (many?) will soon start rejecting these certs.

    If you are still using SHA1-signed certificates; stop. This applies to all versions of TLS and also non-SSL/TLS uses of certificates such as email encryption and code signing.

So in conclusion, "SHAttered" does not provide any additional reason to use 1.2, but there was already good reason for 1.2. It does provide more reason to use SHA2 certificates -- everywhere, not just TLS. The only actual reason to switch to 1.2 because of "SHAttered" is because the publicity, noise, hype, fearmongering, and widespread incomprehension give you leverage to pry resources and approvals out of managers who don't understand the issue anyway.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.