Ike.ninja

Use of the SHA-2 cryptographic signature algorithm has received a significant boost in the wake of the Heartbleed Bug.

More than half a million SSL certificates were potentially compromised as a result of the Heartbleed vulnerability — affected certificates require urgent re-issuance and revocation. The good news is that many of the new certificates have been signed with the SHA-2 algorithm instead of the less secure SHA-1 algorithm, which has helped the total number of certificates signed with SHA-2 increase by more than 50% over the past month.

Practical attacks against the SHA-1 algorithm are now within reach of government agencies, giving them the opportunity to construct a pair of different SSL certificates with the same SHA-1 digest. Ultimately, this could enable an attacker to impersonate secure websites using a variant of the attack that worked against MD5 in 2008. This attack is, however, made more difficult by path constraints and the inclusion of unpredictable data into the certificate before signing it.

Even before the Heartbleed bug was announced, the migration to SHA-2 was inevitable, if not rapid. The long-term shift to SHA-2 is being fuelled by Microsoft’s SHA-1 deprecation policy: Windows will stop accepting certificates signed using SHA-1 from 2017. It is in the interest of certificate authorities to begin the migration as soon as possible, otherwise long-term certificates could become useless partway through their lifetime.

In response to the potential dangers, the National Institute of Standards and Technology (NIST) issued a special publication which disallowed the use of SHA-1 after December 2013. Embarrassingly, NIST ignored its own recommendation and deployed a SHA-1 certificate on its own secure website at www.nist.gov in January 2014.

NIST was not alone in being slow to heed its recommendations: more than 92% of all SSL certificates issued in January were signed with SHA-1. However, the number of certificates using SHA-1 has noticeably declined in the past couple of months. This shift has undoubtedly been assisted by the publication of the Heartbleed Bug, prompting website administrators to deploy new SSL certificates long before their existing certificates were due to expire.

Nearly 200,000 valid third-party certificates are now signed with SHA-2. Despite showing impressive growth, certificates signed with SHA-2 account for 6.6% of all valid third-party certificates currently in use on the web; but this is still a significant jump from last month’s share of 4.3%, and is likely to continue at a strong rate.

The latest version of the CA/Browser Forum’s Baseline Requirements for the Issuance and Management of Publicly-Trusted Certificates [PDF] states that SHA-1 may still be used in subscriber certificates until SHA-256 (part of the SHA-2 family) is supported by a substantial portion of relying-parties worldwide. Arguably, this time has long passed — even Windows XP, which is no longer supported by Microsoft, has been able to accept certificates signed with SHA-256, SHA-384 and SHA-512 since the release of Service Pack 3 in 2008.