Ars Technica |
Hoping to avert “collision” with disaster, Microsoft retires SHA1
Ars Technica The state-sponsored Flame malware that targeted Iran pulled off the only known in-the-wild collision attack earlier this decade. Using a never-before seen technique to subvert the MD5 algorithm, Flame-infected computers were able to pose as official … |
Microsoft is retiring two widely used cryptographic technologies that are growing increasingly vulnerable to attacks that seemed unlikely just a decade ago.
The company’s software will stop recognizing the validity of digital certificates that use the SHA1 cryptographic algorithm after 2016, officials said on Tuesday. SHA1 is widely used to underpin secure socket layer (SSL) and transport layer security (TLS) certificates that authenticate websites and encrypt traffic passing between their servers and end users. SHA1-based certificates are also used to digitally verify that specific software applications are legitimate and not imposter programs or programs that have been tampered with to include hidden backdoors.
The move comes as hardware improvements and research breakthroughs have made SHA1 and several other cryptographic hashing algorithms more susceptible to so-called collision attacks. Collisions occur when two distinct plaintext “messages” produce an identical hash or “digest.” The security of an algorithm rests on it producing unique hashes for each plaintext string or file. The growing ease of producing collisions makes it possible for attackers to create digital forgeries that completely undermine the security of systems that rely on the weak algorithms.
Read 7 remaining paragraphs | Comments
     |
Lance Marrow
Although historians may characterize 2011 differently than I do, I believe that many in the government and public safety arena likely will remember this as the “Year of the Natural Disaster.” From the unparalleled Japanese tsunami to wildfires and tornadoes that literally destroyed entire communities and droughts that plagued many parts of the United States, we have come face-to-face with natural disasters of epic proportions.
read more