Why Google is Hurrying the Web to Kill SHA-1

Re:Why Google is Hurrying the Web to Kill SHA-1 by tptacek on Monday September 08, 2014 @12:32PM (#8285674)

The SHA1 vulnerability being contemplated here affects only the establishment of an HTTPS connection; the attack scenario involves obtaining a forged certificate.

[ Parent | on HN ]

Re:Why Google is Hurrying the Web to Kill SHA-1 by rictic on Monday September 08, 2014 @01:15PM (#8285925)

That's an especially pedantic correction, as it does not impact the meaning of the statement.

s/the weak SHA-1 encryption/the weakened SHA-1 hash used to verify the certificate that's used to authenticate the encrypted connection/

[ Parent | on HN ]

Re:Why Google is Hurrying the Web to Kill SHA-1 by tptacek on Monday September 08, 2014 @01:23PM (#8285983)

It is, you're right. It's a hobbyhorse of mine, though, because SHA1 (and MD5) appear in TLS ciphersuites as MAC components, and those uses are not known to be vulnerable at all.

[ Parent | on HN ]