Microsoft and Apple Signal the Ultimate Death of SHA-1: Are You Ready?

guest · Jun 24, 2019

Microsoft and Apple Signal the Ultimate Death of SHA-1: Are You Ready?
It's time to say goodbye to SHA-1
June 24, 2019
https://dzone.com/articles/microsoft-and-apple-signal-the-ultimate-death-of-s

[...] SHA-1, has been demonstrated to be pretty weak over the past few years. The standard was first published in 1995, and cryptographic algorithms are seldom strong after 24 years.

Why is it a bad idea for enterprises to continue to us SHA-1? A series of SHA-1 attacks started in 2005. But the first major dent in SHA-1’s armor was “The Shappening” in October 2015. [...] “The Shappening” was an improved technique that made SHA-1 seem weaker than ever.
[...] Google’s SHAttered in February 2017. It really... broke stuff.

[...] must support SHA-2 code signing by July 16, 2019 [...] Customers running legacy OS versions (Windows 7 SP1, Windows Server 2008 R2 SP1, and Windows Server 2008 SP2) will be required to have SHA-2 code signing support installed on their devices by July 2019.
On June 5th, Apple announced a number of new TLS certificate requirements for iOS 15 and macOS 10.15, including dropping SHA-1 support. [...] These steps mean Apple sees validity in Gartner’s claim that ‘70% of all attacks will use SSL’ by next year and are being proactive in their response.”
Click to expand...

So, those in the know about cryptography and machine identities have made it clear. We all must say goodbye to SHA-1 and removing it from all of our deployed technologies is worth the effort right now, whatever the challenges may be.
Click to expand...

guest · Jul 29, 2020

Microsoft to remove all Windows downloads signed with SHA-1
July 29, 2020
https://www.bleepingcomputer.com/ne...move-all-windows-downloads-signed-with-sha-1/

Microsoft is removing all Windows downloads from the Microsoft Download Center that are signed using SHA-1 certificates on August 3rd, 2020.
The SHA-1 algorithm was commonly used to code-sign executables and TLS and SSL certificates used on web sites to authenticate a publisher's legitimacy.

Due to the problems with SHA-1 certificates, Microsoft and other developers have been moving away from SHA-1 certificates and requiring SHA-2 to be used to install Windows updates.
Microsoft removing all SHA-1 signed content
In a new support bulletin published yesterday, Microsoft states that they are retiring all Windows content signed with the Secure Hash Algorithm 1 (SHA-1) from the Microsoft Download Center to increase security.

"Microsoft no longer uses SHA-1 to authenticate Windows operating system updates due to security concerns associated with the algorithm, and has provided the appropriate updates to move customers to SHA-2 as previously announced. [...]" Microsoft stated in the support bulletin.
Click to expand...

If there are older SHA-1 signed files on the Microsoft Download Center that you still routinely use, you should download them before Microsoft removes them on August 3.
Click to expand...

Microsoft: SHA-1 Windows content to be retired August 3, 2020

To support evolving industry security standards, and continue to keep you protected and productive, Microsoft will retire content that is Windows-signed for Secure Hash Algorithm 1 (SHA-1) from the Microsoft Download Center on August 3, 2020. This is the next step in our continued efforts to adopt Secure Hash Algorithm 2 (SHA-2), which better meets modern security requirements and offers added protections from common attack vectors.
Click to expand...

Log in or Sign up

Microsoft and Apple Signal the Ultimate Death of SHA-1: Are You Ready?

guest Guest

guest Guest

Log in or Sign up

Microsoft and Apple Signal the Ultimate Death of SHA-1: Are You Ready?

guest Guest

guest Guest

Useful Searches