25

I noticed that today after I scanned a site on the Qualys SSL Labs site that SSL ciphersuites which use SHA1 are now highlighted as being "Weak". It seems this has just happened; I scan sites pretty regularly and haven't seen this before.

We have all known for some time that SHA1 has some weaknesses. Does this change reflect some new problems with SHA1? Has something officially changed in the industry to now have SHA1-based ciphersuites considered "weak"? Or is this just something the Qualys site is choosing to do now?

Improve this question
4
  • 2
    Note that using a SHA-1 based certificate for your site doesn't make it any less secure. The problem is browsers accepting those certificates and CAs creating them.
    – CodesInChaos
    Commented Sep 16, 2014 at 17:20
  • 1
    "As importantly, the security community needs to make changing certificates a lot less painful, because security upgrades to the web shouldn't have to feel like an emergency." - Ease of use is like an afterthought in a lot of security solutions, so itt this is deserved criticism. "Everyone! I have the perfect airtight security model!" said the old man. "Ok that sounds good. How do I incorporate it into our pre-existing solution?" said the young dev. "Good luck!" said the old man.
    – Andrew Hoffman
    Commented Sep 16, 2014 at 20:16
  • Completely agree. The conventional wisdom is that ease of use has an inverse relationship with security, and to a certain extent this is true. OK, it's completely true. However, if you make your site right, the slope doesn't have to be steep. In other words, much more security doesn't necessarily have to mean much less ease of use.
    – trysis
    Commented Sep 17, 2014 at 0:18
  • For the server owner, SHA-1 isn't insecure as @CodesInChaos said, but SHA-1 certificates can be faked with some effort.
    – user10008
    Commented Sep 17, 2014 at 0:35

3 Answers 3

Reset to default
22

Nothing has changed in the industry. Qualys is now just highlighting what we already know.

It is to give you a reminder that you should move away from SHA-1. It's not generally considered a critical problem yet, but should be sorted as part of normal refresh/update cycles.

Improve this answer
17

It is because google is going to start marking certificates that use sha1 as insecure from 2017.

Some more info Why google is hurrying the web to kill sha1

Improve this answer
3
  • This answer effectively says "X is, because Y does Z because X". The answer to "why does Entity X say Y is Z?" can't be simply "Entity A is Act B because C", where C = Z (Qualys are saying SHA-1 based certs are weak because Google is going to warn about them because they are weak). The answer would be C' = Z' where those are the reason entities A and X are stating C and Z, respectively.
    – user
    Commented Sep 17, 2014 at 19:44
  • 11
    @MichaelKjörling Your comment is X + Z * C times harder to decipher than this answer...
    – Chris Cirefice
    Commented Sep 18, 2014 at 5:44
  • Extended discussion about the Google move in Security Now ep. 473 grc.com/securitynow.htm
    – user13695
    Commented Nov 15, 2014 at 12:19
16

Qualys' forums have your answer: https://community.qualys.com/blogs/securitylabs/2014/09/09/sha1-deprecation-what-you-need-to-know

They started to flag SHA-1 7 days ago.

Improve this answer
3
  • SHA-2 has some dents in the armor, but I guess few people are ready for SHA-3 yet.
    – hobbs
    Commented Sep 17, 2014 at 2:01
  • 1
    @hobbs does it? WP says "SHA-3 is not meant to replace SHA-2, as no significant attack on SHA-2 has been demonstrated. Because of the successful attacks on MD5 and SHA-0 and theoretical attacks on SHA-1, NIST perceived a need for an alternative, dissimilar cryptographic hash, which became SHA-3." Is that out-of-date?
    – Nick T
    Commented Feb 8, 2015 at 14:18
  • 1
    @NickT nah, that's about right. We're still pretty far from a practical attack on SHA-2, just some inroads made on reduced-round variants.
    – hobbs
    Commented Feb 9, 2015 at 20:24

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .