Hacker News Reader

Comment by mwsherman | Hacker News Reader

This is a classic case of the perfect vs the good. The question is not whether SHA1 is “acceptable”, but whether it is better than the alternative, which is plain text for users that cannot do SHA256. It’s graceful degradation.

The number quoted of $70K to crack SHA1 indicates that it is non-trivial to hack. Which means adversaries could break the encryption, but could only afford to attack a small number of people. Which means that SHA1 is effective for a large majority.

View on HN

> Which means adversaries could break the encryption, but could only afford to attack a small number of people

No, because an attacker could forge a single CA certificate that could then be used to sign certificates for an unlimited number of websites. This is what the MD5 attack did: https://www.win.tue.nl/hashclash/rogue-ca/

That attack shouldn't work these days even if you can achieve a hash collision. It requires the ability to predict the entire contents of the certificate issued by the CA and I think CAs have since moved to using unpredictable serial numbers in order to prevent this.

Alas, random serial numbers are only a "SHOULD" in the Baseline Requirements, and not all CAs use them.

It's $70K per certificate you're colliding, not $70K per user. A single expenditure of $70K before the end of the year gets you a valid SHA-1 facebook.com certificate with your own private key, which you can use in as many MITMs as you want. (That is, this is not an attack on the encryption, where it's $70K to decrypt a conversation; it's an attack on the signature of the certificate.)

There are loads of millionaires and rich companies with an interest in security in Silicon Valley. Why haven't any of them made us a proof-of-concept certificate?

I suppose because this is a concept that doesn't need a test of truth anymore to be proven. It is accepted and easy enough to be verified mathematically.

I'd like to think that a secure Internet is not too "perfect", but rather that an insecure one is broken and should be fixed.

[too late to edit] My understanding of what a cracked SHA1 amounts to (per cert, not per user) was wrong. Seems obvious after explanation. Thanks.

Reply on news.ycombinator.com