Subject: SHA 1 vs. SHA 256 for Root CA

From: "ROGER YOUNGLOVE" <[email-masked]>
Date: Mon, 29 Jan 2007 09:38:41 -0500

We are standing up a number of CAs (Selfsigned Root, Policy and Issueing).
The question has come up with the Microsoft CA product we have the ability 
to chose SHA 1, SHA 256, SHA 512. i believe that SHA1 is not sufficent for a 
20 year root CA lifespan. I need expert support for moving to SHA 256 at a 
minimum.

Roger Younglove
Principal Consultant
Ford Motor Company

---

From: "Ogle Ron" <[email-masked]>
Date: Mon, 29 Jan 2007 11:22:07 -0500

What size are you planning for your CA keys ?  If you are going to use
RSA 1024, then SHA1 is probably ok.  Also, look at the applications that
you will be using especially for the near future.  They may not work
correctly with anything other than SHA1.  Later on, you could always
re-issue your CA certs with the same keys but with the newer SHA 256
algorithm.

IMHO, go for the ease of use and interoperability than trying to ensure
that everything is extremely secure/unbreakable.

Ron Ogle

-----Original Message-----
From: [email-masked] [mailto:[email-masked]]
On Behalf Of ROGER YOUNGLOVE
Sent: Monday, January 29, 2007 9:39 AM
To: [email-masked]
Subject: SHA 1 vs. SHA 256 for Root CA

We are standing up a number of CAs (Selfsigned Root, Policy and
Issueing).
The question has come up with the Microsoft CA product we have the
ability 
to chose SHA 1, SHA 256, SHA 512. i believe that SHA1 is not sufficent
for a 
20 year root CA lifespan. I need expert support for moving to SHA 256 at
a 
minimum.

Roger Younglove
Principal Consultant
Ford Motor Company

---

From: "Santosh Chokhani" <[email-masked]>
Date: Mon, 29 Jan 2007 07:58:37 -0800

I do not see a problem with using SHA-1 for a self-signed certificate.
A self-signed certificate is vulnerable to modification and substitution
and hence must be protected using other means while stored or
communicated.

Thus, SHA-1 for self-signed root is fine.  SHA-256 will not protect it
any better.

You can not say the same about the certificates issued by the Root. 

-----Original Message-----

Roger Younglove
Principal Consultant
Ford Motor Company

---

From: Russ Housley <[email-masked]>
Date: Mon, 29 Jan 2007 11:22:37 -0500

Roger:

I strongly encourage the use of SHA-256 (over SHA-1) for a signature 
that needs to stand for 20 years.

What key size are you choosing that will also be acceptable in 2027?

Russ

At 09:38 AM 1/29/2007, ROGER YOUNGLOVE wrote:

>ability to chose SHA 1, SHA 256, SHA 512. i believe that SHA1 is not 
>sufficent for a 20 year root CA lifespan. I need expert support for 
>moving to SHA 256 at a minimum.
>
>Roger Younglove
>Principal Consultant
>Ford Motor Company

---

From: Paul Hoffman <[email-masked]>
Date: Mon, 29 Jan 2007 09:22:38 -0800

At 9:38 AM -0500 1/29/07, ROGER YOUNGLOVE wrote:
>i believe that SHA1 is not sufficent for a 20 year root CA lifespan.

It would be useful to know where that belief comes from. To date, 
there have been no suggestions of any weakness for SHA-1 against 
preimage attacks. Also to date, no one has suggested that it is 
possible for anyone to brute-force a cryptographic primitive that 
would require 2^160 iterations.

--Paul Hoffman, Director
--VPN Consortium

---

From: "ROGER YOUNGLOVE" <[email-masked]>
Date: Mon, 29 Jan 2007 12:36:47 -0500

Gentlemen,
Thank you for the rapid response. One thing I did not mention was that we 
are using a Micorsoft CA implentation from Windows Server 2003 EE.
We just found out that this CA product does not recognize SHA 256 or above 
even though it is an option.

TTFN
Roger Younglove

>From: "Ogle Ron" <[email-masked]>
>To: "ROGER YOUNGLOVE" <[email-masked]>, <[email-masked]>
>Subject: RE: SHA 1 vs. SHA 256 for Root CA
>Date: Mon, 29 Jan 2007 11:22:07 -0500
>
>

---

From: Mike <[email-masked]>
Date: Mon, 29 Jan 2007 10:16:12 -0800

What RFC defines the OID's, etc. for RSA with SHA-256 et. al.?
Is there a DSA standard that uses SHA-256?

Thanks,

Mike

---

From: Stephen Kent <[email-masked]>
Date: Mon, 29 Jan 2007 13:44:55 -0500

At 12:36 PM -0500 1/29/07, ROGER YOUNGLOVE wrote:
>Gentlemen,
>Thank you for the rapid response. One thing I did not mention was 
>that we are using a Micorsoft CA implentation from Windows Server 
>2003 EE.
>We just found out that this CA product does not recognize SHA 256 or 
>above even though it is an option.
>
>
>
>TTFN
>Roger Younglove

OK. Guess that narrows the options a bit :-).

Also, upon further reflection, I agree that since this is a 
self-signed cert, which presumably has been delivered via an 
out-of-band path that is considered integrity secure, the concerns 
over use of SHA-1 may be overstated.

Steve

---

From: Russ Housley <[email-masked]>
Date: Mon, 29 Jan 2007 14:09:34 -0500

Paul:

According to the NIST recommendations 2^80 (the strength of SHA-1if 
none of the attacks prove to be fruitful) is useful for digital 
signatures until 2010.

The request was about signatures that need to stand for 20 years -- 
if they are signed today, that is 2027.  The NIST recommendations for 
beyond 2030 seem appropriate, which recommend SHA-256 and a key size 
of 3072 bits.

Russ

---

From: "Kemp, David P." <[email-masked]>
Date: Mon, 29 Jan 2007 15:15:46 -0500

Is this still a potential issue for Issuing CA certificates signed
with the root key, particularly if the profile permits non-critical
extensions?

-----Original Message-----
From: [email-masked] [mailto:[email-masked]]
On Behalf Of Stephen Kent
Sent: Monday, January 29, 2007 1:45 PM
To: ROGER YOUNGLOVE
Cc: [email-masked]
Subject: RE: SHA 1 vs. SHA 256 for Root CA

Steve

---

From: "Santosh Chokhani" <[email-masked]>
Date: Mon, 29 Jan 2007 10:59:37 -0800

Paul,

It is not clear why pre-image issue is relevant.  The root public key or
self-signed certificate needs protections other than own signature and
hence hashing algorithm strength is not an issue.  Signature on the
certificate buys nothing security wise.

-----Original Message-----
From: [email-masked] [mailto:[email-masked]]
On Behalf Of Paul Hoffman
Sent: Monday, January 29, 2007 12:23 PM
To: ROGER YOUNGLOVE; [email-masked]
Subject: Re: SHA 1 vs. SHA 256 for Root CA

At 9:38 AM -0500 1/29/07, ROGER YOUNGLOVE wrote:
>i believe that SHA1 is not sufficient for a 20 year root CA lifespan.

--Paul Hoffman, Director
--VPN Consortium

---

From: Russ Housley <[email-masked]>
Date: Mon, 29 Jan 2007 15:57:51 -0500

>What RFC defines the OID's, etc. for RSA with SHA-256 et. al.?

RFC 4055

Russ

---

From: Russ Housley <[email-masked]>
Date: Mon, 29 Jan 2007 16:02:00 -0500

>over use of SHA-1 may be overstated.

I think that Santosh's note explained the point about self-signed 
certificates.  In my response, I assumed that the same signature 
algorithm would be used for certificates that are subordinate to the 
self-signed certificate.  Thus my comments about 20 year validity periods.

If the self-signed public keys are being used to validate digital 
signatures, similar issues arise.

Russ

---

From: Stephen Kent <[email-masked]>
Date: Mon, 29 Jan 2007 17:01:22 -0500

>signatures, similar issues arise.

Agreed.

Roger, where do you pan to use the hash algorithm in question?

Steve

---

From: "Moudrick M. Dadashov" <[email-masked]>
Date: Tue, 30 Jan 2007 00:25:21 +0200 (EET)

Hello,

anybody knows what is the source of so called "Friendly Name" displayed by
Microsoft certificate viewer? I can't find any extensions for this field
either.

Can we define a "Friedly Name" under the RSA KEON server?

Thanks,

M.D.

---

From: yannick quenechdu <[email-masked]>
Date: Tue, 30 Jan 2007 00:29:55 +0100

> Microsoft certificate viewer? I can't find any extensions for this field
The cert associated with the private key had "friendly name" associated 
with it. Is similar with alias in JKS file or see
openssl when you create PKCS12, you have a option "Friendly Name".

Note : friendly names are optional in windows but required by NSS 
(mozilla). If the PKCS12 file was created without a
friendly name for the cert, that's why it failed.

Regards
Yannick Quenec(hdu
www.ejbca.org / PKI Opensource

---

From: Francis Dupont <[email-masked]>
Date: Tue, 30 Jan 2007 09:42:22 +0100

In your previous mail you wrote:

   
=> perhaps Moudrick was looking for the OID?
iso(1) member-body(2) US(840) rsadsi(113549) pkcs(1) pkcs9(9) friendlyName(20)

In openssl pkcs12 related options are:
-name "name"  use name as friendly name
-caname "nm"  use nm as CA friendly name (can be used more than once).

Regards

[email-masked]

PS: PKCS9 is RFC 2985 too, friendlyName is section 5.5.1, syntax is:

   friendlyName ATTRIBUTE ::= {
           WITH SYNTAX BMPString (SIZE(1..pkcs-9-ub-friendlyName))
           EQUALITY MATCHING RULE caseIgnoreMatch
           SINGLE VALUE TRUE
           ID pkcs-9-at-friendlyName
   }

with

   pkcs-9-ub-pkcs9String         INTEGER ::= 255
   pkcs-9-ub-friendlyName        INTEGER ::= pkcs-9-ub-pkcs9String

   pkcs-9 OBJECT IDENTIFIER ::= {iso(1) member-body(2) us(840)
                                 rsadsi(113549) pkcs(1) 9}
   pkcs-9-at-friendlyName             OBJECT IDENTIFIER ::= {pkcs-9 20}

---

From: Ryan Hurst <[email-masked]>
Date: Tue, 30 Jan 2007 05:55:25 -0800

CryptoAPI doesn't (normally) use Friendly Names as extensions in
certificates but instead uses them as properties that stored with a
certificate, it's a label provided by the user/application at generation
time that can be used to identify a specific certificate without
certificate specific knowledge.

Think of values like "My Bank Certificate", "My Work Certificate", etc.

When CryptoAPI exports a certificate into a P12 it also stores (if I
recal correctly) the friendly name if it was there.

Ryan

-----Original Message-----
From: [email-masked] [mailto:[email-masked]]
On Behalf Of Francis Dupont
Sent: Tuesday, January 30, 2007 12:42 AM
To: yannick quenechdu
Cc: [email-masked]; [email-masked]
Subject: Re: source of "Friendly name" 

   > Microsoft certificate viewer? I can't find any extensions for this
field
   The cert associated with the private key had "friendly name"
associated 
   with it. Is similar with alias in JKS file or see
   openssl when you create PKCS12, you have a option "Friendly Name".

=> perhaps Moudrick was looking for the OID?
iso(1) member-body(2) US(840) rsadsi(113549) pkcs(1) pkcs9(9)
friendlyName(20)

Regards

with

---

From: "David Simonetti" <[email-masked]>
Date: Tue, 30 Jan 2007 09:18:09 -0500 (EST)

Given these recommendations, how, for example, would I validate a digital
signature on an s/mime email signed using SHA-256 using Microsoft Outlook
running on Windows XP?  Is this only possible by using third party crypto
software?

Dave S.

-- 
Regards,
David Simonetti
Jacob & Sundstrom, Inc.
410-356-1067

---

From: David Cross <[email-masked]>
Date: Tue, 30 Jan 2007 14:37:35 -0800

Hi Dave:

Responding only for your specific query, Windows Vista and Office 2007 support both SHA-256 as well as other SuiteB algorithms.  Unfortunately, SHA-2 support in Outlook is not currently possible with Windows XP and/or Office XP.

David B. Cross

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of David Simonetti
Sent: Tuesday, January 30, 2007 6:18 AM
To: Russ Housley
Cc: Stephen Kent; ROGER YOUNGLOVE; [email-masked]
Subject: RE: SHA 1 vs. SHA 256 for Root CA

Dave S.

--
Regards,
David Simonetti
Jacob & Sundstrom, Inc.
410-356-1067