Microsoft is Abandoning SHA-1 Hashes for Updates

Re:Microsoft is Abandoning SHA-1 Hashes for Updates by londons_explore on Wednesday February 20, 2019 @05:53AM (#19207010)

I might not be understanding this right... But can't they dual sign with both SHA1 and SHA2 with no loss of functionality?

New clients would use (and require) the SHA2 hash. Old clients could still use the SHA1 hash, but with the risk of a faked update, but that's probably still better than no update.

[ Parent | on HN ]

Re:Microsoft is Abandoning SHA-1 Hashes for Updates by __s on Wednesday February 20, 2019 @06:35AM (#19207135)

https://news.ycombinator.com/item?id=19206527

Sounds like they were already dual signing, & are now phasing out SHA1. Only as secure as the weakest signature you accept

[ Parent | on HN ]

Re:Microsoft is Abandoning SHA-1 Hashes for Updates by userbinator on Wednesday February 20, 2019 @08:00AM (#19207475)

But can't they dual sign with both SHA1 and SHA2 with no loss of functionality?

Furthermore, wouldn't trying to collide both SHA2 and SHA1 be even more close to impossible than just trying to collide SHA2 (which is already currently regarded as practically impossible)? Perhaps newer clients should verify both hashes?

[ Parent | on HN ]

Re:Microsoft is Abandoning SHA-1 Hashes for Updates by tialaramex on Wednesday February 20, 2019 @08:58AM (#19207792)

No. Amateurs bring this up _all the time_. Depending on exactly what's going on, it may be no harder to attack _both_ than just the hardest of the two component hashes, plus you just wasted a bunch of effort and maybe introduced extra security bugs with your extra complexity. So don't do this.

The compatibility argument makes sense, but the "maybe it's safer" argument doesn't have any traction at all.

And the politics always ends up being "We don't want to endorse this unsafe thing, let's just remove it".

[ Parent | on HN ]

Re:Microsoft is Abandoning SHA-1 Hashes for Updates by userbinator on Wednesday February 20, 2019 @08:40PM (#19213818)

Depending on exactly what's going on, it may be no harder to attack _both_ than just the hardest of the two component hashes

We have seen published collisions for MD5 (which are incidentally nearly trivial to generate these days), and I'm aware of the one for SHA-1 (which took much longer to generate) --- but have there been any dual-collisions found? According to you, they wouldn't be that hard to generate, but I haven't been able to find any examples of dual collisions, even for trivially-collidable-by-themselves combinations like MD5+MD4.

[ Parent | on HN ]