headers
Robert J. Hansen | 1 May 2009 03:22
Favicon

New attacks on SHA-1


Some researchers are claiming they've been able to make the Shengdong
University attack on SHA-1 a factor of about 2000 times easier.  If
their research is correct, that means SHA-1 is now attackable by regular
people.

These results are not unexpected.  We knew this day would come.  For the
last couple of years most crypto nerds have been strongly recommending
people either migrate away from SHA-1 immediately, or at the very least
have a migration plan put together.

If you have already migrated -- then you may ignore this development.

If you have not -- then it is increasingly urgent you do so.

Original URL:

http://eurocrypt2009rump.cr.yp.to/837a0a8086fa6ca714249409ddfae43d.pdf
Permalink | Reply | 1 comment |
headers
David Shaw | 1 May 2009 06:00

Re: New attacks on SHA-1

On Apr 30, 2009, at 9:22 PM, Robert J. Hansen wrote:
> Some researchers are claiming they've been able to make the Shengdong
> University attack on SHA-1 a factor of about 2000 times easier. If
> their research is correct, that means SHA-1 is now attackable by  
> regular
> people.
>
> These results are not unexpected. We knew this day would come. For the
> last couple of years most crypto nerds have been strongly recommending
> people either migrate away from SHA-1 immediately, or at the very  
> least
> have a migration plan put together.
>
> If you have already migrated -- then you may ignore this development.
>
> If you have not -- then it is increasingly urgent you do so.
>
Indeed.  Even before this new potential attack, the expected useful  
lifespan of the SHA-1 algorithm was scheduled to run out at the end of  
2010 (as per NIST SP800-57).  If you're still in the theater, it's  
really time to proceed (in a dignified and organized manner) to the  
exits.

For amusement, the other algorithms that "expire" at the end of 2010  
include RIPEMD/160, 1024-bit RSA, and 1024-bit DSA.  I don't think  
there are many 1024-bit RSA keys still out there, but there is an  
awful lot of 1024-bit DSA as it is the default key type in GPG.

David
(Continue reading)

Permalink | Reply | 0 comments |
headers
Joseph N. | 1 May 2009 17:29

Re:New attacks on SHA-1

> For the last couple of years most crypto nerds have been strongly
> recommending people either migrate away from SHA-1 immediately, or at
> the very least have a migration plan put together.

Would an appropriate migration plan be to create/upload new keys and to 
revoke all older ones that were based on the deprecated hashes?

-- 
JN

------------------------------------

______________________________________________________________
Archives:                  http://groups.yahoo.com/group/PGP-Basics/messages
OT List:                         http://groups.yahoo.com/group/PGP-Basics-OT
OT Subscribe:                 mailto:PGP-Basics-OT-subscribe <at> yahoogroups.com

Gossamer Spider Web of Trust                           https://www.gswot.orgYahoo! Groups Links

<*> To visit your group on the web, go to:
    http://groups.yahoo.com/group/PGP-Basics/

<*> Your email settings:
    Individual Email | Traditional

<*> To change settings online go to:
    http://groups.yahoo.com/group/PGP-Basics/join
    (Yahoo! ID required)

<*> To change settings via email:
(Continue reading)

Permalink | Reply | 1 comment |
headers
Robert J. Hansen | 1 May 2009 17:58
Favicon

Re: New attacks on SHA-1

Joseph N. wrote:
> Would an appropriate migration plan be to create/upload new keys and to 
> revoke all older ones that were based on the deprecated hashes?

There is nothing intrinsically wrong with what you're talking about.  If
you do it right, it can also be good practice.

If you have a checklist for what to do when you revoke a key, try
following it and see how well it works.  If you don't, now's a great
time to make one.  Once you have your checklist written up, you can use
it the next time you need to revoke a key.

It's human nature to screw things up -- but coming up with a plan,
following the plan and then improving the plan... that's just good
engineering.  :)

------------------------------------

______________________________________________________________
Archives:                  http://groups.yahoo.com/group/PGP-Basics/messages
OT List:                         http://groups.yahoo.com/group/PGP-Basics-OT
OT Subscribe:                 mailto:PGP-Basics-OT-subscribe <at> yahoogroups.com

Gossamer Spider Web of Trust                           https://www.gswot.orgYahoo! Groups Links

<*> To visit your group on the web, go to:
    http://groups.yahoo.com/group/PGP-Basics/

<*> Your email settings:
    Individual Email | Traditional
(Continue reading)

Permalink | Reply | 0 comments |
headers
Joseph N. | 2 May 2009 21:11

Re: New attacks on SHA-1

>> Would an appropriate migration plan be to create/upload new keys
>> and to revoke all older ones that were based on the deprecated
>> hashes?
> 
> There is nothing intrinsically wrong with what you're talking about.
> If you do it right, it can also be good practice.

I've done it before, so I think I'm good with it, but a new issue came 
to mind:

I've never gone down the sign-one-key-with-another route.  Would this be 
a good situation to do that in order to engender trust, or--cuz I don't 
totally understand what "signing" means--would that action somehow 
weaken the new key?

--

-- 
JN

------------------------------------

______________________________________________________________
Archives:                  http://groups.yahoo.com/group/PGP-Basics/messages
OT List:                         http://groups.yahoo.com/group/PGP-Basics-OT
OT Subscribe:                 mailto:PGP-Basics-OT-subscribe <at> yahoogroups.com

Gossamer Spider Web of Trust                           https://www.gswot.orgYahoo! Groups Links

<*> To visit your group on the web, go to:
    http://groups.yahoo.com/group/PGP-Basics/
(Continue reading)

Permalink | Reply | 0 comments |
headers
Marc J. Miller | 2 May 2009 23:31
Picon
Gravatar

RE: New attacks on SHA-1

A signature means "I believe this key (and/or email address) belongs to the person named."

The more signatures a key has, the more you can trust it.  So signing a completely new key with the old key adds
some assurance because there is a lot of trust in your old key, but it's still just one signature so it
doesn't inherit all of that trust.  Consider that each sig is still prone to human error.

For this situation, I suggest you generate a new subkey rather than a completely new key.  Anyone else care to
weigh in?  

-----Original Message-----
From: Joseph N. <jbn10161 <at> fastmail.fm>
Sent: Saturday, May 02, 2009 12:11 PM
To: PGP-Basics <at> yahoogroups.com
Subject: Re: New attacks on SHA-1

>> Would an appropriate migration plan be to create/upload new keys
>> and to revoke all older ones that were based on the deprecated
>> hashes?
> 
> There is nothing intrinsically wrong with what you're talking about.
> If you do it right, it can also be good practice.

I've done it before, so I think I'm good with it, but a new issue came 
to mind:

I've never gone down the sign-one-key-with-another route.  Would this be 
a good situation to do that in order to engender trust, or--cuz I don't 
totally understand what "signing" means--would that action somehow 
weaken the new key?
(Continue reading)

Permalink | Reply | 1 comment |
headers
Joseph N. | 2 May 2009 23:52

Re:New attacks on SHA-1

Does the significance of this issue affect only encryption keys, or also 
signature keys?  While it seems likely to me that it would have to 
affect signature keys, although obviously with different effects, my 
real issue relates to the remedy.  GnuPG, at least when operated through 
GPGshell, allows DSA signing keys only up to 1024.  Am I missing 
something?  Or should I just worry about the encryption key?

-- 
JN

------------------------------------

______________________________________________________________
Archives:                  http://groups.yahoo.com/group/PGP-Basics/messages
OT List:                         http://groups.yahoo.com/group/PGP-Basics-OT
OT Subscribe:                 mailto:PGP-Basics-OT-subscribe <at> yahoogroups.com

Gossamer Spider Web of Trust                           https://www.gswot.orgYahoo! Groups Links

<*> To visit your group on the web, go to:
    http://groups.yahoo.com/group/PGP-Basics/

<*> Your email settings:
    Individual Email | Traditional

<*> To change settings online go to:
    http://groups.yahoo.com/group/PGP-Basics/join
    (Yahoo! ID required)

<*> To change settings via email:
(Continue reading)

Permalink | Reply | 1 comment |
headers
Robert J. Hansen | 2 May 2009 23:59
Favicon

Re: New attacks on SHA-1

Joseph N. wrote:
> Does the significance of this issue affect only encryption keys, or
> also signature keys?

It affects signature keys far moreso than encryption keys.

> GnuPG, at least when operated through GPGshell, allows DSA signing
> keys only up to 1024.

Add "enable-dsa2" to your gpg.conf file and try again.

------------------------------------

______________________________________________________________
Archives:                  http://groups.yahoo.com/group/PGP-Basics/messages
OT List:                         http://groups.yahoo.com/group/PGP-Basics-OT
OT Subscribe:                 mailto:PGP-Basics-OT-subscribe <at> yahoogroups.com

Gossamer Spider Web of Trust                           https://www.gswot.orgYahoo! Groups Links

<*> To visit your group on the web, go to:
    http://groups.yahoo.com/group/PGP-Basics/

<*> Your email settings:
    Individual Email | Traditional

<*> To change settings online go to:
    http://groups.yahoo.com/group/PGP-Basics/join
    (Yahoo! ID required)
(Continue reading)

Permalink | Reply | 0 comments |
headers
Robert J. Hansen | 3 May 2009 00:44
Favicon

Re: New attacks on SHA-1

Marc J. Miller wrote:
> The more signatures a key has, the more you can trust it.

This is dangerously wrong.  Very dangerously wrong.

If I give you a key with 5,000 signatures, none of which are from keys
you know and have verified, really, how valid is it?

If I give you a key with 5,000 signatures, one of which is from a key
you know and have verified and whose owner you trust, how valid is it?

If I give you a key with 5,000 signatures, all of which come from keys
you know and have verified and whose owners you trust, how valid is it?

The answers are "not at all," "completely," and "completely."

The number of signatures doesn't matter.  The presence of just one
correct signature from a validated key belonging to a trusted user...
that matters quite a lot.

> For this situation, I suggest you generate a new subkey rather than a
> completely new key.  Anyone else care to weigh in?

Let me see if I've got this straight.  You are counseling that:

* SHA-1 is dangerously weak.
* If your primary signing key uses SHA-1, you should generate a new
  signing subkey using a better algorithm.
* Don't revoke your keypair.
(Continue reading)

Permalink | Reply | 0 comments |
headers
Marc J. Miller | 3 May 2009 01:56
Picon
Gravatar

RE: Re:New attacks on SHA-1

In GnuPG they're the same key.  When you sign a message without encrypting it you provide a hash that is used to
verify the message.  The signature can only be created by your private key (which only you have) and can be
verified using your public key (which can be viewed by everyone).  When you encrypt, you use the
recipient's public key to hide the contents of the message, but only the recipient's private key can
decode it.

However signing a key is different from signing an email.  Signing a key is a way to leave a mark on someone's
key that "I trust this key."  Signing a message is used to verify that it hasn't been modified.  Completely
different concept.

-----Original Message-----
From: Joseph N. <jbn10161 <at> fastmail.fm>
Sent: Saturday, May 02, 2009 2:52 PM
To: PGP-Basics <at> yahoogroups.com
Subject: Re:New attacks on SHA-1

Does the significance of this issue affect only encryption keys, or also 
signature keys?  While it seems likely to me that it would have to 
affect signature keys, although obviously with different effects, my 
real issue relates to the remedy.  GnuPG, at least when operated through 
GPGshell, allows DSA signing keys only up to 1024.  Am I missing 
something?  Or should I just worry about the encryption key?

--

-- 
JN

------------------------------------

______________________________________________________________
Archives:                  http://groups.yahoo.com/group/PGP-Basics/messages
(Continue reading)

Permalink | Reply | 503 comments |

Gmane