<story><title>Why it’s harder to forge a SHA-1 certificate than to find a SHA-1 collision</title><url>https://blog.cloudflare.com/why-its-harder-to-forge-a-sha-1-certificate-than-it-is-to-find-a-sha-1-collision/</url></story><parent_chain></parent_chain><comment><author>agwa</author><text>We&amp;#x27;re lucky that hash collision attacks have a relatively simple mitigation like this. (Although you have to trust CAs to follow the rules and implement it properly, and events of the last few years indicate that CAs need to have as few things to screw up as possible.)&lt;p&gt;However, we&amp;#x27;re not always going to be so lucky.  The next major transition in digital certificates could very well be to post-quantum crypto due to advancements in quantum computing.  Under that scenario, attackers will be able to simply compute a CA&amp;#x27;s private key and sign arbitrary certificates.  There will be no mitigation short of clients ceasing to trust pre-quantum certs.  But clients won&amp;#x27;t be able to do that unless servers are using post-quantum certs, and server operators won&amp;#x27;t want to do that if it would mean cutting off legacy clients that don&amp;#x27;t support post-quantum certs.&lt;p&gt;The solution to this first mover problem is to set a hard deadline after which legacy certs are retired.  This forces clients and server operators to act.  Pushing back the SHA-1 deadline at the 11th hour as CloudFlare proposes sends a dangerous message that such deadlines don&amp;#x27;t have to be taken seriously.  This message will come back to haunt the Internet in the future.</text></comment>
<story><title>Why it’s harder to forge a SHA-1 certificate than to find a SHA-1 collision</title><url>https://blog.cloudflare.com/why-its-harder-to-forge-a-sha-1-certificate-than-it-is-to-find-a-sha-1-collision/</url></story><parent_chain></parent_chain><comment><author>KirinDave</author><text>It&amp;#x27;s worth noting that SHA1 is also suitable for use in HMAC on older hardware, security is not significantly compromised by SHA1&amp;#x27;s properties.&lt;p&gt;You can move to more modern algorithms, but there isn&amp;#x27;t a pressing need to remove SHA1 implementations for that application.</text></comment>