NIST says you better dump weak SHA-1 ... by 2030
(2022/12/16)
- Reference: 1671157693
- News link: https://www.theregister.co.uk/2022/12/16/nist_sets_sha1_retirement_date/
- Source link:
The US National Institute of Standards and Technology (NIST) says it's time to retire Secure Hash Algorithm-1 (SHA-1), a 27-year-old weak algorithm used in security applications.
"We recommend that anyone relying on SHA-1 for security migrate to SHA-2 or SHA-3 as soon as possible," said NIST computer scientist Chris Celi, in [1]a canned statement on Thursday.
As soon as possible isn't necessarily all that soon: NIST says you should be rid of SHA-1 from your software and systems by December 31, 2030. Meanwhile, the tech industry has largely moved on already.
[2]
SHA-1 is among seven hash algorithms approved for use in the Federal Information Processing Standard (FIPS) [3]180-4 . By the end of 2030, FIPS 180-5, the next revision of government's hash standard, will no longer include SHA-1 as a supported specification
[4]
[5]
NIST intends to update [6]SP 800-131A and other relevant NIST publications to reflect the retirement of SHA-1. In addition, it's looking to publish a transition strategy for validating cryptographic modules and algorithms.
A SHA-1 hash is made by mapping a message of arbitrary length to a fixed-length message digest consisting of 160 bits, typically represented by 40 hexadecimal digits. For example, the message "password" results in the SHA-1 digest 5baa61e4c9b93f3f0682250b6cf8331b7ee68fd8 .
[7]
Hashes are not supposed to be reversible but simple message inputs like "password" can be [8]pre-computed and put in lookup tables , which makes it trivial to derive dictionary-stored input messages from corresponding hash digests, assuming they're unsalted – combined with an additional value for enhanced security.
NIST deprecated SHA-1 in 2011 and disallowed its use in digital signature creation and verification with limited exceptions in 2013 as a result of [9]a theoretical collision attack described in 2005 that became [10]practical in 2017
A collision attack is when two input messages produce the same hash value as output. For applications like digital signatures or file checksums, you don't want collisions because they violate security assumptions about uniqueness. It's suboptimal when a legitimate program and a malicious program share the same hash value.
[12]
By 2015, companies like Facebook, Google, Microsoft, and Mozilla were already [13]planning to distance themselves from SHA-1. By 2017, the major web browsers stopped recognizing SHA-1 certificates but it took a while [14]for the rest of the industry to catch up.
[15]Brexit trade deal advises governments to use Netscape Communicator and SHA-1. Why? It's all in the DNA
[16]Microsoft reprieves SHA-1 deprecation in Edge 85 security baseline
[17]YOU... SHA-1 NOT PASS! Microsoft magics away demonic hash algorithm from Windows updates, apps
[18]Got $50k spare? Then you can crack SHA-1 – so OpenSSH is deprecating flawed hashing algo in a 'near-future release'
Despite its known weakness, SHA-1 has shown up in recent years propping up [19]legacy applications and providing [20]shoddy password storage . Microsoft finally got around to dropping SHA-1 from the Windows update process [21]in August 2020 .
Even if it's not actively used much, SHA-1 remains widely available. NIST's Cryptographic Algorithm Validation Program, which validates cryptographic algorithms for vendors, includes [22]2,272 cryptographic modules validated in the past five years that still support SHA-1.
These modules, the building blocks of cryptographic systems, do not necessarily use SHA-1 but they support it. So companies incorporating any of these modules in their products should be looking for revised versions that exclude the outdated algorithm. And the makers of these modules cannot sit idly by either since the Feds require cryptographic modules to be validated every five years.
Celi explains that modules still using SHA-1 after 2030 will be ineligible for purchase by the federal government. Having eight years to submit an update may seem like more than enough time, but Celi warns there may be a backlog of submissions as the deadline nears. Developers wishing to avoid a potential validation delay should submit revised code sooner rather than later. ®
Get our [23]Tech Resources
[1] https://www.nist.gov/news-events/news/2022/12/nist-retires-sha-1-cryptographic-algorithm
[2] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2Y5v7bn8gjR4Zu2eF2bW86wAAAE4&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[3] https://csrc.nist.gov/publications/detail/fips/180/4/final
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44Y5v7bn8gjR4Zu2eF2bW86wAAAE4&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[5] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33Y5v7bn8gjR4Zu2eF2bW86wAAAE4&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[6] https://csrc.nist.gov/publications/detail/sp/800-131a/rev-2/final
[7] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44Y5v7bn8gjR4Zu2eF2bW86wAAAE4&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[8] https://crackstation.net/
[9] https://link.springer.com/chapter/10.1007/11535218_2
[10] https://www.theregister.com/2017/02/23/google_first_sha1_collision/
[11] https://web.archive.org/web/20180515222208/http://shattered.io/static/shattered.pdf
[12] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33Y5v7bn8gjR4Zu2eF2bW86wAAAE4&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[13] https://www.theregister.com/2015/12/22/googles_sha1_snuff_plan_is_catching_up_with_microsoft_mozilla/
[14] https://www.theregister.com/2017/03/08/sha1_certificate_survey/
[15] https://www.theregister.com/2020/12/31/brexitl_obsolete_tech_explained/
[16] https://www.theregister.com/2020/08/31/microsoft_edge_sha_1_revival/
[17] https://www.theregister.com/2020/07/29/microsoft_windows_sha_1/
[18] https://www.theregister.com/2020/05/28/openssh_deprecating_sha1/
[19] https://www.theregister.com/2020/08/31/microsoft_edge_sha_1_revival/
[20] https://www.theregister.com/2021/02/22/nurserycam_breach/
[21] https://www.theregister.com/2020/07/29/microsoft_windows_sha_1/
[22] https://csrc.nist.gov/projects/cryptographic-algorithm-validation-program/validation-search?searchMode=validation&productType=-1&algorithm=129&dateFrom=01%2F01%2F2018&ipp=100
[23] https://whitepapers.theregister.com/
"We recommend that anyone relying on SHA-1 for security migrate to SHA-2 or SHA-3 as soon as possible," said NIST computer scientist Chris Celi, in [1]a canned statement on Thursday.
As soon as possible isn't necessarily all that soon: NIST says you should be rid of SHA-1 from your software and systems by December 31, 2030. Meanwhile, the tech industry has largely moved on already.
[2]
SHA-1 is among seven hash algorithms approved for use in the Federal Information Processing Standard (FIPS) [3]180-4 . By the end of 2030, FIPS 180-5, the next revision of government's hash standard, will no longer include SHA-1 as a supported specification
[4]
[5]
NIST intends to update [6]SP 800-131A and other relevant NIST publications to reflect the retirement of SHA-1. In addition, it's looking to publish a transition strategy for validating cryptographic modules and algorithms.
A SHA-1 hash is made by mapping a message of arbitrary length to a fixed-length message digest consisting of 160 bits, typically represented by 40 hexadecimal digits. For example, the message "password" results in the SHA-1 digest 5baa61e4c9b93f3f0682250b6cf8331b7ee68fd8 .
[7]
Hashes are not supposed to be reversible but simple message inputs like "password" can be [8]pre-computed and put in lookup tables , which makes it trivial to derive dictionary-stored input messages from corresponding hash digests, assuming they're unsalted – combined with an additional value for enhanced security.
NIST deprecated SHA-1 in 2011 and disallowed its use in digital signature creation and verification with limited exceptions in 2013 as a result of [9]a theoretical collision attack described in 2005 that became [10]practical in 2017
[11]PDF
.A collision attack is when two input messages produce the same hash value as output. For applications like digital signatures or file checksums, you don't want collisions because they violate security assumptions about uniqueness. It's suboptimal when a legitimate program and a malicious program share the same hash value.
[12]
By 2015, companies like Facebook, Google, Microsoft, and Mozilla were already [13]planning to distance themselves from SHA-1. By 2017, the major web browsers stopped recognizing SHA-1 certificates but it took a while [14]for the rest of the industry to catch up.
[15]Brexit trade deal advises governments to use Netscape Communicator and SHA-1. Why? It's all in the DNA
[16]Microsoft reprieves SHA-1 deprecation in Edge 85 security baseline
[17]YOU... SHA-1 NOT PASS! Microsoft magics away demonic hash algorithm from Windows updates, apps
[18]Got $50k spare? Then you can crack SHA-1 – so OpenSSH is deprecating flawed hashing algo in a 'near-future release'
Despite its known weakness, SHA-1 has shown up in recent years propping up [19]legacy applications and providing [20]shoddy password storage . Microsoft finally got around to dropping SHA-1 from the Windows update process [21]in August 2020 .
Even if it's not actively used much, SHA-1 remains widely available. NIST's Cryptographic Algorithm Validation Program, which validates cryptographic algorithms for vendors, includes [22]2,272 cryptographic modules validated in the past five years that still support SHA-1.
These modules, the building blocks of cryptographic systems, do not necessarily use SHA-1 but they support it. So companies incorporating any of these modules in their products should be looking for revised versions that exclude the outdated algorithm. And the makers of these modules cannot sit idly by either since the Feds require cryptographic modules to be validated every five years.
Celi explains that modules still using SHA-1 after 2030 will be ineligible for purchase by the federal government. Having eight years to submit an update may seem like more than enough time, but Celi warns there may be a backlog of submissions as the deadline nears. Developers wishing to avoid a potential validation delay should submit revised code sooner rather than later. ®
Get our [23]Tech Resources
[1] https://www.nist.gov/news-events/news/2022/12/nist-retires-sha-1-cryptographic-algorithm
[2] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2Y5v7bn8gjR4Zu2eF2bW86wAAAE4&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[3] https://csrc.nist.gov/publications/detail/fips/180/4/final
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44Y5v7bn8gjR4Zu2eF2bW86wAAAE4&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[5] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33Y5v7bn8gjR4Zu2eF2bW86wAAAE4&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[6] https://csrc.nist.gov/publications/detail/sp/800-131a/rev-2/final
[7] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44Y5v7bn8gjR4Zu2eF2bW86wAAAE4&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[8] https://crackstation.net/
[9] https://link.springer.com/chapter/10.1007/11535218_2
[10] https://www.theregister.com/2017/02/23/google_first_sha1_collision/
[11] https://web.archive.org/web/20180515222208/http://shattered.io/static/shattered.pdf
[12] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33Y5v7bn8gjR4Zu2eF2bW86wAAAE4&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[13] https://www.theregister.com/2015/12/22/googles_sha1_snuff_plan_is_catching_up_with_microsoft_mozilla/
[14] https://www.theregister.com/2017/03/08/sha1_certificate_survey/
[15] https://www.theregister.com/2020/12/31/brexitl_obsolete_tech_explained/
[16] https://www.theregister.com/2020/08/31/microsoft_edge_sha_1_revival/
[17] https://www.theregister.com/2020/07/29/microsoft_windows_sha_1/
[18] https://www.theregister.com/2020/05/28/openssh_deprecating_sha1/
[19] https://www.theregister.com/2020/08/31/microsoft_edge_sha_1_revival/
[20] https://www.theregister.com/2021/02/22/nurserycam_breach/
[21] https://www.theregister.com/2020/07/29/microsoft_windows_sha_1/
[22] https://csrc.nist.gov/projects/cryptographic-algorithm-validation-program/validation-search?searchMode=validation&productType=-1&algorithm=129&dateFrom=01%2F01%2F2018&ipp=100
[23] https://whitepapers.theregister.com/
Trusted for deduplication too
Kevin McMurtrie
Some will say that the odds of a SHA-1 collision for file deduplication are an impossible 1 in 2^160. On the flip side, math says that if you are hashing files with 100 million bits, there could be up to 2^99999840 collisions. I once saw a colliding cryptographic-strength UUID glitch a financial system. My trust is that large computer systems can brute-force their way through impossible odds.
Ah, I remember the good old days when computers were slow and a "1 in a million" bug was something you had a day or two to fix.
Re: Trusted for deduplication too
Lil Endian
Granted, proven broken mathematically (2004) and broken practically (2017) then realistically (2020) are different things.
Even if we take today as the start point, 7 years before it's unacceptable is, well, unacceptable IMO.
Largely moved on?
Anonymous Coward
The elephant in the room is git, of course. While it has experimental support for using other hash algorithms at this point, I'm not aware of anyone using anything besides sha1.
Meanwhile, the s3 upload API still only supports md5 for integrity checks, and many people who I work with (in "technically not a developer but their job description sure has a lot of overlap with one" roles) still use md5 out of basically muscle memory.
What the....?
SHA-1 has been known to be broken since at least 2005!
So NIST are saying that a 25 window to stop using it is okay?
A such, NIST should limit themselves to advising on puppy dog tails and raising unicorns.