Subject: [saag] Google announces the first SHA-1 collision

From: Russ Housley <[email-masked]>
Date: Thu, 23 Feb 2017 15:34:52 -0500

https://security.googleblog.com/2017/02/announcing-first-sha1-collision.html

---

From: Russ Housley <[email-masked]>
Date: Thu, 23 Feb 2017 17:05:31 -0500

> https://security.googleblog.com/2017/02/announcing-first-sha1-collision.html

The blog says: "Today, 10 years after of SHA-1 was first introduced, we are announcing …”

SHA-1 is specified in FIPS PUB 180, which is dated 11 May 1993.  That is a lot more than 10 years.

Russ

---

From: "John Levine" <[email-masked]>
Date: 23 Feb 2017 22:15:59 -0000

>SHA-1 is specified in FIPS PUB 180, which is dated 11 May 1993.  That is a lot more than 10 years.

The first cracks against SHA1 were published in 2005.  That is also
more than 10 years ago.

https://www.schneier.com/blog/archives/2005/02/cryptanalysis_o.html

---

From: Stephen Farrell <[email-masked]>
Date: Fri, 24 Feb 2017 01:14:12 +0000

> The first cracks against SHA1 were published in 2005.  That is also

Failings in reportage aside, this is still an interesting
and fine result and one that should be welcomed - reality
being a fine thing:-)  IMO - well done to the authors!

The timeline here I think does re-enforce the approach we
collectively took (at the behest of folks including Russ
at the time) for moving away from sha-1. But I'm sure there're
lessons we can all learn from yet another existence proof
that all crypto algorithms do have a best-before-date even
when we don't know quite what's the right value for that;-)

S.

> _______________________________________________
> saag mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/saag
>

---

From: Michael Richardson <[email-masked]>
Date: Fri, 24 Feb 2017 11:59:18 -0500

Stephen Farrell <[email-masked]> wrote:
    > The timeline here I think does re-enforce the approach we collectively
    > took (at the behest of folks including Russ at the time) for moving
    > away from sha-1. But I'm sure there're lessons we can all learn from
    > yet another existence proof that all crypto algorithms do have a
    > best-before-date even when we don't know quite what's the right value
    > for that;-)

The other lesson is that it appears that the HMAC-SHA1 construct
(like HMAC-MD5) remains unaffected by the attack.
My other impression is that the collisions are longer than the original.

I am most concerned about the git use of SHA-1 (and other at-rest uses of
SHA-1, such as inside certificates).   I am less concerned about the the
session uses, and I think that the PRF uses of SHA-1 are probably immune.

Our move towards AEAD methods means that we are increasingly not using
SHA-1 (or any SHA-x).

It seems to me that most urgent thing is to capture the experiences (and best
practices) we have had in the past 3-5 years on the SHA1->SHA2 switchover,
and make sure that our SHA2 based infrastructure is ready for the next
switchover.

[I think that the push to SHA2 has hurt security at times by training users
to click through warnings, or causing people to use http when https started
to fail]

--
Michael Richardson <[email-masked]>, Sandelman Software Works
 -= IPv6 IoT consulting =-

---

From: Alan DeKok <[email-masked]>
Date: Fri, 24 Feb 2017 12:02:11 -0500

On Feb 24, 2017, at 11:59 AM, Michael Richardson <[email-masked]> wrote:
> I am most concerned about the git use of SHA-1

  Linus seems to think it's OK:

http://marc.info/?l=git&m=148787047422954

  More discussion here:

https://news.ycombinator.com/item?id=13719368

  Alan DeKok.