Re: [saag] sha1 - have we more work to do?

[Derek Atkins <[e-mail]>]

Hi,

Stephen Farrell <[e-mail]> writes:

> Hiya,
>
> While it may be still under submission, and not yet peer reviewed,
> I was just looking at [1,2] and wondered if we've still work to do
> to deprecate sha1 anywhere that we've not yet done. I know a lot
> of this was done already but just wanted to check that we're good.
>
> Anyone know places where sha1 is still a should or must or where it's
> still in widespread use despite no longer being a should or must?
> (No need to mention root stores in browser for that last though, as
> that's a known issue and is I think already being tackled by browser
> makers.)
>
> I guess we can make a list and then figure out what to do if the
> list is non-empty.
>
> Cheers,
> S.
>
> [1] https://sites.google.com/site/itstheshappening/
> [2] https://sites.google.com/site/itstheshappening/shappening_article.pdf

OpenPGP (RFC4880) still uses SHA-1 for its key fingerprints.  However,
it's using the SHA1 preimage resistance and not the SHA1 collision
resistance.  So even though finding collisions in SHA1 appears to be
getting easier, preimage attacks seem still out of reach.  But it'll
probably be easier to change to a new hash algorithm in a V5 key than it
would be to educate everyone on why the way 4880 uses SHA1 isn't
vulnerable to these "new" SHA1 attacks.

-derek

-- 
       Derek Atkins                 617-623-3745
       [e-mail]             www.ihtfp.com
       Computer and Internet Security Consultant