1

As SHA-1 is not recommended, I want to disable the SHA-1 hash algorithm. I used OpenSSL API to set signature algorithm to SSL_CTX,

static INT32 signAlgoList[24] = { NID_sha512, EVP_PKEY_RSA, NID_sha512, EVP_PKEY_DSA, NID_sha512, EVP_PKEY_EC,NID_sha384, EVP_PKEY_RSA, NID_sha512, EVP_PKEY_DSA, NID_sha384, EVP_PKEY_EC, NID_sha256, EVP_PKEY_RSA, NID_sha256, EVP_PKEY_DSA, NID_sha256, EVP_PKEY_EC, NID_sha224, EVP_PKEY_RSA, NID_sha224, EVP_PKEY_DSA, NID_sha224, EVP_PKEY_EC };

Signature algorithm list:

(void)SSL_CTX_set1_client_sigalgs(sCtxMutualAuth, (int *)signAlgoList, 24);
(void)SSL_CTX_set1_sigalgs(sCtxMutualAuth, (int *)signAlgoList, 24);

After including these APIs in my program, SHA-1 is disabled in Windows (I am not seeing SHA-1 in Wireshark logs) but, still SHA-1 is not disabled in Linux (It is showing SHA-1 in Wireshark logs). Is there any other way to disable SHA-1 in Linux?

  • Note : My server is running in Linux and Client in Windows – Karma Yogi Sep 5 '18 at 11:53
  • 1
    Be more specific: which program(s) where are doing exactly what (client or server in TLS)? What protocol version(s)? (Sigalgs only works in 1.2 or 1.3, and only 1.1.1 implements 1.3.) Where/how exactly is SHA1 being used in the trace? (Sigalgs only controls signatures and certs, not HMAC and KDF, although KDF is not visible.) – dave_thompson_085 Sep 6 '18 at 4:59
3

As SHA1 is not recommended, ...

This initial assumption is wrong. The only place where SHA-1 is not recommended is where collision resistance is needed, i.e. signatures (for example signatures on certificates). SHA-1 is still fine to be used as a HMAC, it is still (together with the even older MD5) an essential part of the TLS 1.1 protocol etc.

  • Thats ok, I must disable SHA-1 in my program – Karma Yogi Sep 5 '18 at 11:53
  • Setting sigalgs as the Q does (or at least tries to) does restrict signatures, both protocol-level (ServerKX and CertVerify) and certificate. only for TLS1.2+, but does NOT affect HMAC or KDF (although TLS1.2+ changes the KDF). – dave_thompson_085 Sep 6 '18 at 4:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.