Re: [Dcrup] Time For People To Really Stop Using SHA-1 Signatures?

[Viktor Dukhovni <[e-mail]>]

On Tue, Jan 07, 2020 at 06:41:09PM -0500, Scott Kitterman wrote:

> https://sha-mbles.github.io/
> 
> If I'm reading this right, the last excuse that still trusting SHA-1 DKIM 
> signatures is an OK thing to do is gone.  Comments from anyone that really 
> understands thus stuff would be appreciated.

Well, weak DKIM signatures create the possibility of message forgery, where a
signed message from the attacker can later be replaced by another signed
message.  But if the attacker can post messages via your server, he would
in most cases just post the ultimately desired message.

Supposing however that for some reason modified message replay is an appealing
attack, then the attacker needs to be able to mount the SHA-1 chosen-prefix
attack in the context of a line-oriented message transport where arbitrary
binary data can be tricky to embed in the message.

So I don't think there's a crisis that requires drop-everything urgent action,
but indeed this would be a good time to start phasing out SHA-1 signatures,
if you have not done so already.

-- 
    Viktor.