Re: [Dcrup] Time For People To Really Stop Using SHA-1 Signatures?

[Viktor Dukhovni <[e-mail]>]

On Tue, Jan 14, 2020 at 09:16:00AM -0500, Hector Santos wrote:

> I read a statement the OpenSSL folks were thinking about removing it.

There are no such plans.  Rather, in some future releases the use of
SHA-1 in digital signatures (whether in X.509, or in TLS handshake
signatures) will probably only work at "security level 0".

The default security level for TLS is level 1 (notionally 80 bits),
which currently admits SHA-1.  When/if SHA-1 is downgraded (not
removed) X.509 certificates using SHA-1 will fail to validate at
level 1, and TLS handshake signatures using SHA1, MD5 or SHA-1||MD5
will not be considered valid.  That effectively rules out TLS 1.0
and TLS 1.1.  So the change would need to made with care, giving
the laggards some time to finally migrate to TLS 1.2.

Non-TLS applications default to level 0 (no floor on algorithm
strength), but can choose a stricter level for certificate verification.

HMAC-SHA1 remains unbroken, and so there are no plans to deprecate
SHA-1 ciphersuites from TLS, but these days you're more likely to
negotiate an AEAD cipher.

> That would be a horrible decision and it just someone's belief, not
> the OpenSSL team because then we really create REAL damage by forcing
> SHA1 signatures fails which are otherwise secured right now.

Let's not fill the void with wild speculation.

> Lets fix the real Rewrite potential problems first before worrying 
> about SHA1.

This isn't an either/or choice, deprecate SHA1 signing, *and* other
issues that warrant attention.

-- 
    Viktor.