Is the warning given by chrome warranted?

Question

I went to a payment page on a site recently, and chrome was warning me that the page is possibly not secure, I have a very basic understanding of crypto but not enough to fully understand why this page is possibly not secure.

The cert comes from Thawte, which from what I found on google is a well trusted CA, however the cert's signature algorithm and hash algorithm are sha1RSA and sha1 respectively. I was under the impression that these were obsolete and have been for quite some time ?

The page uses AES-128-CBC which I understand to be relatively insecure by it's self but the messages are authenticated with HMAC-SHA1. And after reading this I understand this to be secure given that the private key is secure which it should be given that the key exchange is RSA. So as far as I understand this makes the whole thing secure? Is that correct?

To summarize :

1. Is my understanding correct?
2. If not, why not ?
3. Is this page secure and why/why not?

Answer 1

There are four issues (basically all you can get at once I think) going on with your connection to this site which is why Chrome warns you.

The first one is quite easy to spot: The usage of SHA-1 for the certificate signature. SHA-1 is generally considered deprecated and should not be used for scenarios where collision resistance is required, like certificate hashing. A well-funded attacker may be able to create two valid certificates having the exact same SHA-1 hash, it's only a matter of time until someone presents the first such collision to us (maybe some agency?).

And to actually answer this part of the question: Yes, SHA-1 has been considered obsolete for quite some time now, but people tend not to move away from things until there's a real threat, although many CAs need do the transition. The second reason for why they may still use is that they got a 4-year certificate back in 2012 (and those tend to be expensive) and deprecating SHA-1 wasn't a thing back then as much as it is today (Google's post is from 2014).

The second warning you observe is the lack of certificate transparency. Certificate transparency is Google's action against fraudelent CAs issuing certificates to people who shouldn't be able to get those certificates. They do this by "forcing" everyone to publish the issued certificates into a set of logs so everyone can identify if his domain is subject to such attacks. This is still in the early stages and not by-default supported by many CAs. It will only remove the EV bar if you're using Chrome.

The third issue on this warning page is mixed content. This means parts of the page are served over unencrypted connections and may pose a security threat to you as they can be observed and altered by anyone in between you and the server. This may cause a noticable warning.

The fourth issue is the use of AES-CBC + HMAC-SHA1. Note that indeed HMAC-SHA1 is still safe and will be for quite some time. Note further that there indeed exists security proofs for the way TLS handles CBC+HMAC.

However, CBC failed quite a bit in the past (POODLE and others) and even some TLS implementations were vulnerable. Furthermore CBC has quite severe requirements on the IVs used for each packet (they need to be unpredictable as opposed to be "just" unique). And of course it's harder to correctly use CBC+HMAC than it is to just an AEAD scheme (such as GCM) as you have to take care of a lot more stuff (keys, call the MAC in the right place, generate correct IVs). The last point on TLS' CBC+HMAC is that the security proof is considered "bad". TLS uses MAC-then-Encrypt when using CBC which doesn't have a security proof as generic as Encrypt-then-MAC has making it potentially more error-prone. It is for these reasons Chrome considers connections made using CBC as obsolete and why only AEAD modes are allowed for TLS v1.3.

TL;DR: SHA-1 is indeed deprecated but getting rid of it takes time and AES-CBC+HMAC-SHA1 has provable security but is considered "obsolete" and error-prone for quite some reasons so Chrome issues you the warnings.

Answer 2

the cert's signature algorithm and hash algorithm are sha1RSA and sha1 respectively. I was under the impression that these were obsolete and have been for quite some time?

Yup, and that is indeed the problem. You're right that HMAC-SHA1 is still safe. RSA signatures, however, do not use HMAC: they just use a hash of the message to produce the signature. Attacks on this hash function can be used to attack the signature scheme as a whole. Since SHA-1 is broken, it's no longer safe to use it in signature schemes either.