Google and CWI announced SHAttered, an attack on the SHA-1 cryptographic hash function. The attack was demonstrated by allowing the cryptographic signature on a good PDF to be the same as on a bad PDF. In other words, they forged the signature.
We have previously reviewed implementation of SHA-2, but with Bruce Schneier stating the need to migrate away from SHA-1 and the SHA-1 deprecation policy from Microsoft, the industry must start to make some progress in 2014.
If you have yet to migrate to SHA-2, check out Entrust Datacard’s SHA-2 Migration Guide. It will help you plan and execute a successful SHA-2 migration to avoid extra costs, eliminate service disruptions and ensure compliance.
Entrust Datacard shares announcement from Google on September 5, 2014, that Chrome will sunset SHA-1 by providing security warnings through the popular browser. SHA-1 is a secure hash algorithm used when signing SSL certificates. SHA-1 provides a unique 160-bit hash value representing the certificate. The hash value is designed so it cannot be the same for two different certificates.
The migration of from SHA-1 to SHA-2 SLL certificates is not trivial and has the potential to cause major problems, particularly if the process is not carefully planned and all affected parties are not considered. Entrust Datacard helps you to navigate this transition smoothly to ensure nothing is overlooked; all technological implications are considered; technology is implemented properly; and people know what to do in the event issues arise.