Subject: Re: [TLS] Deprecating TLS 1.0, 1.1 and SHA1 signature algorithms

From: David Benjamin <[email-masked]>
Date: Fri, 05 Feb 2016 20:07:49 +0000

On Mon, Jan 11, 2016 at 6:17 PM David Benjamin <[email-masked]>
wrote:

> In terms of getting rid of TLS 1.0 and TLS 1.1 altogether, we're seeing
> around 3% of connections using TLS 1.0 or TLS 1.1. That's quite high, and
> it's likely that enterprise deployments are much worse.
>
> I started gathering numbers on ServerKeyExchange hashes back in November.
> The code isn't on Chrome's stable channel yet, but earlier channels say a
> bit over 5% of ServerKeyExchanges are signed with SHA-1, which is also
> quite high.
>
> I also started probing servers in November and observed:
> (a) Servers which always sign SHA-1.
>

Lest anyone get their hopes up, it turns out OpenSSL-based servers before
1.0.1j that use SNI (specifically those that call SSL_set_SSL_CTX in the
SNI callback) ignore the signature_algorithms extension and only sign
SHA-1. We'll be stuck with this one for a long while. 1.0.1j was only
released 2014-10-15, and Linux distributions tend to be on older versions
with backported security fixes to say nothing of folks that don't update at
all.
https://rt.openssl.org/Ticket/Display.html?id=3560

David

> (b) Servers which sign SHA-1 *unless* signature_algorithms omits it. Then
> they sign SHA-256!?!!?
> (c) Servers which sign SHA-2 but fail if signature_algorithms omits SHA-1.
> The ones I looked at were all from serving SHA-1 certificates, so probably
> their SSL stack compares certs against sig_algs.
>
> (b) and (c) mean that getting a sense of the true impact will be
> complicated until we finish getting SHA-1 certificates out of our system. I
> have not dug into what's going on with groups (a) and (b) yet.
>
> This all is not to say we shouldn't phase these out. But I do not expect
> it to be a speedy process for browsers.
>
> David
>
> On Mon, Jan 11, 2016 at 1:30 PM Kurt Roeckx <[email-masked]> wrote:
>
>> Hi,
>>
>> After the SLOTH paper, we should think about starting to deprecate
>> TLS 1.0 and TLS 1.1 and the SHA1 based signature algorithms in TLS
>> 1.2.
>>
>> As I understand it, they estimate that both TLS 1.2 with SHA1 and
>> TLS 1.0 and 1.1 with MD5|SHA1 currently require about 2^77 to be
>> broken.  They all depend on the chosen prefix collision on SHA1,
>> with the MD5 part in TLS 1.0 and 1.1 not adding much.
>>
>> It seems that disabling SHA1 in TLS 1.2 doesn't buy you anything
>> unless you also disable TLS 1.0 and 1.1.
>>
>>
>> Kurt
>>
>> _______________________________________________
>> TLS mailing list
>> [email-masked]
>> https://www.ietf.org/mailman/listinfo/tls
>>
>