Re: [keyassure] Opening issue #21: "Need to specify which crypto

[Phillip Hallam-Baker <[e-mail]>]

Plenty is not the point.

SHA1 is no longer regarded as acceptably secure. SHA2 is based on the
same construction and is thus similarly suspect.

We don't use SHA1 in legacy browsers because we like it. We use SHA1
in legacy browsers because we have not worked out how to transition
away from it. The transition from MD5 to SHA1 was painless only
because all browsers were required to support both standards.



This particular topic is one on which the Security ADs and the IETF
chair have very very specific opinions on. And given their role in
trying to effect an industry wide transition to stronger algorithms, I
think that they are quite right to insist on them.


On Tue, Mar 1, 2011 at 1:15 PM, Martin Rex <[e-mail]> wrote:
> Phillip Hallam-Baker wrote:
>>
>> Currently, the only digest algorithm that can be recommended is SHA-2
>>
>> We really do need SHA2 in here as a MUST, unless we are still discussing
>> this when the SHA3 competition results are out.
>
> SHA-256 looks like plenty.
>
> You do realize, that many (if not most) implementations of TLS are going
> to use SHA-1 for digital signatures for quite some time to come?
>
> And even document like the updated TLS extensions document (rfc6066)
> use SHA-1 all over the place.
>
> -Martin
>



-- 
Website: http://hallambaker.com/