Microsoft is recommending that customers and CA’s stop using SHA-1 for cryptographic applications, including use in SSL/TLS and code signing. Microsoft Security Advisory 2880823 has been released along with the policy announcement that Microsoft will stop recognizing the validity of SHA-1 based certificates after 2016.
Secure Hashing Algorithm 1 (SHA-1) is a message digest algorithm published in 1995 as part of NIST’s Secure Hash Standard. A hashing algorithm is considered secure only if it produces unique output for any given input and that output cannot be reversed (the function only works one-way).
Since 2005 there have been known collision attacks (where multiple inputs can produce the same output), meaning that SHA-1 no longer meets the security standards for a producing a cryptographically secure message digest.
For attacks against hashing algorithms, we have seen a pattern of attacks leading up to major real-world impacts:
Short history of MD5 Attacks
Source: Marc Stevens, Cryptanalysis of MD5 and SHA-1
It appears that SHA-1 is on a similar trajectory:
Microsoft is actively monitoring the situation and has released a policy for deprecating SHA-1 by 2016.
Microsoft recommends that Certificate Authorities (CA’s) stop using SHA-1 for digital signatures and that consumers request SHA-2 certificates from CA’s.
Microsoft has publicized a new policy that calls for users and CA’s to stop using SHA1-based certificates by 2016.
- William Peteroy, MSRC
I would like to thank the Microsoft PKI team as well as Ali Rahbar of the MSRC Engineering team for their hard work and input.