Re: [saag] SHA-1 is a Shambles: First Chosen-Prefix Collision on SHA-1

[Watson Ladd <[e-mail]>]

On Thu, Jan 9, 2020 Peter Gutman wrote

>
> A simple countermeasure there for long-lived signatures where this type of
> attack is a threat (assuming the ASN.1-reinterpretation is achievable),
> e.g.
> X.509 certs in legacy deployments, is that if SHA-1 is being used, reject
> certs with an unknown extension, or one with type-and-value fields of
> unknown
> type.
>

Let's look at actual exploitation of a chosen prefix attack in the CA
ecosystem. This happened twice, once as a talk demo and another time as
part of a cyberattack.

http://deweger.xs4all.nl/papers/[41]StSoApLeMoOsdW-RogueCA-Crypto[2009].pdf

Did the attackers succeed? Yes
Did they need a custom extension? No
Does the countermeasure work? No

Why is this less work then disabling SHA-1 verification 14 years after
Wang's attacks, 3 years after the Web PKI disabled SHA-1 etc?

There are some other countermeasures like injecting randomized large serial
numbers, but these aren't followed uniformly by CAs outside the Web PKI.

Beyond cryptography there are all manner of other attacks that require
updating. It's clear that slow update cycles and backwards compatibility
have had substantial negative impacts on security.