Subject: [saag] sha1 - have we more work to do?

From: Stephen Farrell <[email-masked]>
Date: Fri, 9 Oct 2015 14:25:40 +0100

Hiya,

While it may be still under submission, and not yet peer reviewed,
I was just looking at [1,2] and wondered if we've still work to do
to deprecate sha1 anywhere that we've not yet done. I know a lot
of this was done already but just wanted to check that we're good.

Anyone know places where sha1 is still a should or must or where it's
still in widespread use despite no longer being a should or must?
(No need to mention root stores in browser for that last though, as
that's a known issue and is I think already being tackled by browser
makers.)

I guess we can make a list and then figure out what to do if the
list is non-empty.

Cheers,
S.

[1] https://sites.google.com/site/itstheshappening/
[2] https://sites.google.com/site/itstheshappening/shappening_article.pdf

---

From: Yoav Nir <[email-masked]>
Date: Fri, 9 Oct 2015 17:07:48 +0300

> On Oct 9, 2015, at 4:25 PM, Stephen Farrell <[email-masked]> wrote:
> 
> 
> Hiya,
> 

 - SHA-1 is used less and less in signatures, but HMAC-SHA1 is still very 
   widespread, although it is not supposed to be affected by collision 
   attacks.
 - IKE (RFC 7296) has a few places where SHA-1 is a non-negotiated MUST:
   - NAT detection works by sending SHA-1 hashes of the IP addresses and
     IKE ports. Considering that for IPv4 there are only 2^32 possible 
     inputs to the hash function, I don’t think it matters which function
     is used.
   - The hash&URL certificate encoding relies on SHA-1 hashes. An attacker 
     could MITM the HTTP connection and provide a bad certificate if they 
     could create a 2nd pre-image certificate that is properly signed.
   - The Certificate Request payload has SHA-1 hashes of the SPKIs in the
     certification authority certificates.

Yoav

---

From: Benjamin Kaduk <[email-masked]>
Date: Fri, 9 Oct 2015 20:19:46 -0400 (EDT)

>    widespread, although it is not supposed to be affected by collision

Indeed, HMAC-SHA1 (truncated to 96 bit, sigh) is used by the only Kerberos
encryption types you should be using if you do not deal with Japanese
government organizations.  (There are people still using arcfour-hmac,
triple-des, and yes even single-des, but we're working on that.)

-Ben

---

From: Derek Atkins <[email-masked]>
Date: Mon, 12 Oct 2015 11:10:29 -0400

Hi,

> [2] https://sites.google.com/site/itstheshappening/shappening_article.pdf

OpenPGP (RFC4880) still uses SHA-1 for its key fingerprints.  However,
it's using the SHA1 preimage resistance and not the SHA1 collision
resistance.  So even though finding collisions in SHA1 appears to be
getting easier, preimage attacks seem still out of reach.  But it'll
probably be easier to change to a new hash algorithm in a V5 key than it
would be to educate everyone on why the way 4880 uses SHA1 isn't
vulnerable to these "new" SHA1 attacks.

-derek

-- 
       Derek Atkins                 617-623-3745
       [email-masked]             www.ihtfp.com
       Computer and Internet Security Consultant