Security Advisory 2880823: Recommendation to discontinue use of SHA-1

Microsoft is recommending that customers and CA’s stop using SHA-1 for cryptographic applications, including use in SSL/TLS and code signing. Microsoft Security Advisory 2880823 has been released along with the policy announcement that Microsoft will stop recognizing the validity of SHA-1 based certificates after 2016.

Background

Secure Hashing Algorithm 1 (SHA-1) is a message digest algorithm published in 1995 as part of NIST’s Secure Hash Standard. A hashing algorithm is considered secure only if it produces unique output for any given input and that output cannot be reversed (the function only works one-way).

Since 2005 there have been known collision attacks (where multiple inputs can produce the same output), meaning that SHA-1 no longer meets the security standards for a producing a cryptographically secure message digest.

For attacks against hashing algorithms, we have seen a pattern of attacks leading up to major real-world impacts:

Short history of MD5 Attacks

Source: Marc Stevens, Cryptanalysis of MD5 and SHA-1

• 1992: MD5 published
• 1993: Pseudo-collision attack
• 2004: Identical-prefix collision found in 2^40 calls
• 2006: chosen-prefix collision found in 2^49 calls
• 2009: identical-prefix and chosen prefix optimized to 2^16 and 2^39 calls respectively, Rouge CA practical attacks implemented

It appears that SHA-1 is on a similar trajectory:

• 1995: SHA-1 published
• 2005: SHA-1 collision attack published in 2^69 calls
• 2005: NIST recommendation for movement away from SHA-1
• 2012: Identical-prefix collision 2^61 calls presented
• 2012: Chosen-prefix collision 2^77.1 calls presented

Current Issues

Microsoft is actively monitoring the situation and has released a policy for deprecating SHA-1 by 2016.

Microsoft Recommendations

Microsoft recommends that Certificate Authorities (CA’s) stop using SHA-1 for digital signatures and that consumers request SHA-2 certificates from CA’s.

Microsoft Policy

Microsoft has publicized a new policy that calls for users and CA’s to stop using SHA1-based certificates by 2016.

- William Peteroy, MSRC

I would like to thank the Microsoft PKI team as well as Ali Rahbar of the MSRC Engineering team for their hard work and input.