Re: [saag] SHA-1 is a Shambles: First Chosen-Prefix Collision on SHA-1

Even more precise, the hash algorithm in X.509 certificate trust anchors
doesn't matter for security. Self-signed X.509 certs are the most common
trust anchors.

If a self-signed cert is a part of a certificate chain, it must be a trust
anchor. Therefore, the hash algorithm in a self-signed X.509 certificate
never matters for security. This should include compliance reasons of "no
SHA-1" because the signature field on self-signed cert should never be
verified (we can, but it just wastes compute cycles).

Remarkably, the above straightforward facts are for some reason not
well-understood and companies make an effort to remove X.509 trust anchors
with SHA-1 in signatures over them.

On Tue, Jan 7, 2020, 5:49 PM Phillip Hallam-Baker <phill@hallambaker.com>
wrote:

> Those certificates are not actually at risk because they were originally
> signed when SHA-1 was still trusted. It is the intermediate and EE certs
> that are the concern.
>
> On the cost of attack thing. $11K is well within the amount of computer
> time that can be stolen...
>
>
>
>
> On Tue, Jan 7, 2020 at 8:46 PM Jeffrey Walton <noloader@gmail.com> wrote:
>
>> On Tue, Jan 7, 2020 at 10:23 AM Russ Housley <housley@vigilsec.com>
>> wrote:
>> >
>> > https://eprint.iacr.org/2020/014
>> >
>> > > SHA-1 is a Shambles - First Chosen-Prefix Collision on SHA-1 and
>> > > Application to the PGP Web of Trust
>> > >
>> > > Gaëtan Leurent and Thomas Peyrin
>> > >
>> > > Abstract: The SHA-1 hash function was designed in 1995 and has been
>> > > widely used during two decades. A theoretical collision attack was
>> first
>> > > proposed in 2004 [WYY05], but due to its high complexity it was only
>> > > implemented in practice in 2017, using a large GPU cluster [SBK+17].
>> > > More recently, an almost practical chosen-prefix collision attack
>> > > against SHA-1 has been proposed [LP19]. This more powerful attack
>> allows
>> > > to build colliding messages with two arbitrary prefixes, which is much
>> > > more threatening for real protocols.
>> > >
>> > > In this paper, we report the first practical implementation of this
>> > > attack, and its impact on real-world security with a PGP/GnuPG
>> > > impersonation attack. We managed to significantly reduce the
>> complexity
>> > > of collisions attack against SHA-1: on an Nvidia GTX 970,
>> > > identical-prefix collisions can now be computed with a complexity of
>> > > 2^61.2 rather than 2^64.7, and chosen-prefix collisions with a
>> complexity
>> > > of 2^63.4 rather than 2^67.1. When renting cheap GPUs, this
>> translates to
>> > > a cost of 11k US$ for a collision, and 45k US$ for a chosen-prefix
>> > > collision, within the means of academic researchers. Our actual attack
>> > > required two months of computations using 900 Nvidia GTX 1060 GPUs (we
>> > > paid 75k US$ because GPU prices were higher, and we wasted some time
>> > > preparing the attack).
>> > >
>> > > Therefore, the same attacks that have been practical on MD5 since 2009
>> > > are now practical on SHA-1. In particular, chosen-prefix collisions
>> can
>> > > break signature schemes and handshake security in secure channel
>> > > protocols (TLS, SSH). We strongly advise to remove SHA-1 from those
>> type
>> > > of applications as soon as possible. We exemplify our cryptanalysis by
>> > > creating a pair of PGP/GnuPG keys with different identities, but
>> > > colliding SHA-1 certificates. A SHA-1 certification of the first key
>> can
>> > > therefore be transferred to the second key, leading to a forgery. This
>> > > proves that SHA-1 signatures now offers virtually no security in
>> > > practice. The legacy branch of GnuPG still uses SHA-1 by default for
>> > > identity certifications, but after notifying the authors, the modern
>> > > branch now rejects SHA-1 signatures (the issue is tracked as
>> > > CVE-2019-14855).
>>
>> And if interested, Mozilla's cacert.pem
>> (https://curl.haxx.se/docs/caextract.html) has 52 certificates at
>> risk:
>>
>> $ ./test.exe
>> Load certificates from cacert.pem
>> Certificates total: 138
>>
>> ecdsa-with-SHA256: 5
>> ecdsa-with-SHA384: 16
>> id_sha1WithRSASignature: 52
>> id_sha256WithRSAEncryption: 56
>> id_sha256WithRSAEncryption: 8
>> id_sha512WithRSAEncryption: 1
>>
>> Jeff
>>
>> _______________________________________________
>> saag mailing list
>> saag@ietf.org
>> https://www.ietf.org/mailman/listinfo/saag
>>
> _______________________________________________
> saag mailing list
> saag@ietf.org
> https://www.ietf.org/mailman/listinfo/saag
>