8

I have a command line to sign an executable using Microsoft's signtool, and one way to identify my certificate is with a sha1 thumbprint. The command looks like:

signtool sign [...] /sha1 <sha1_thumbprint> [...] file.exe

My question is: is the thumbprint considered private? Can I commit the command line to a repository, or is it better to avoid doing that?

1
  • 3
    While the thumbprint itself contains no secret information itself, using the same thumbprint on multiple places reveals that you are using the same certificate on all these places. If you consider this information private or not is up to you. May 30, 2018 at 13:34

1 Answer 1

8

No, thumbprint is not considered private. This is because, thumbprint is a result of one-way hashing function (SHA1 or other).

By definition, hashing functions accepts messages of variable length as input and produce fixed-length output. Output length depends on actual hashing function. As the result, it is virtually impossible to recover input message by knowing only it's hash (thumbprint).

Please note, that there are several types of attacks against hashes (for example, preimage attack) which allow you to find another input that produces same hash value (hash collision). This means that using such attacks you can get N number of inputs that produce particular hash. However, you cannot know which exactly of these inputs in N was in mind to calculate particular hash. Any of element in N could be. This means that you can spoof the thumbprint (although computationally difficult), but you cannot recover exact input, only possible candidates.

So, you can post thumbprint value in public when necessary without worrying that someone will recover input message that produced specified thumbprint.

2
  • 1
    Just to note that "impossible to recover" assumes the search space is big enough and computing power is low enough that recovery is very unlikely even within really long time scales. As we've seen with hashing functions over the past 20 years, technology progresses to the point where an older hashing function becomes brute-forceable.
    – Rikki
    Dec 17, 2019 at 20:57
  • @Rikki sure, but bruteforcing the thumbprint means nothing if the certificate expired a decade ago anyway...
    – ThoriumBR
    Feb 4, 2022 at 12:14

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .