I am using CryptSignMessage to sign a string/file. Is using RSASha1 insecure?

I know Sha1 is broken as a hashing algorithm, but does that also mean that using it for signing with RSA is broken?

  • $\begingroup$ SHA-1 is not broken, it's weak. It's still impractical for anyone that doesn't have enormous resources (e.g. the NSA) to find collisions. That being said, I'd still use SHA-2 since there's no reason not to. $\endgroup$ – flashbang Jan 16 '15 at 15:11
  • $\begingroup$ It is broken now. $\endgroup$ – kenorb Feb 26 '17 at 16:18

To start with, it's certainly not a bad idea to avoid SHA-1 when other algorithms exist, which do not have the SHA-1 weaknesses to anyone's knowledge.

The security of SHA-1 depends on how you're using it. The vulnerability is what's known as a collision vulnerability: an attacker has the ability to create two input strings with the same SHA-1 hash with less computational power than it should take him for a good hash function. However, he does not get to freely pick what either of those input strings is, and he does not necessarily have the ability to feasibly find a string whose hash matches that of any particular string.

If the attacker has any control over anything you're willing to sign, collision attacks might be exploitable. The classic example is two PostScript files; one is a letter of recommendation for an employee named Alice, the other a security clearance for Alice, and they hash to the same MD5 value. Alice presents file 1 to her boss, and then affixes that signature to file 2, now having obtained a security clearance. Likewise, with TLS certificates, security researchers made 2 colliding-under-MD5 certs, one a legitimate one and one a CA one, got the former signed by a real CA, and that signature was valid for the latter. What these have in common is that someone is signing off on something that they did not entirely create. If that describes what you're doing, you should certainly not use SHA-1.

If you entirely create the files you're signing, it's probably fine for now; in that case, the only person who could exploit a collision attack is you, and you're the person who doesn't need to exploit it (you could just sign whatever you want). Also, as far as anyone's aware, no one yet has the hardware to exploit the collision attack (that's likely at least a year off, and more till it's cheap enough for non-high-value targets).

But honestly, why risk it? Just use SHA-2 instead. CryptSignMessage supports it as well, it looks like.

  • $\begingroup$ I am facing the same issue faced here with SHA2 - forums.embarcadero.com/thread.jspa?threadID=96592 $\endgroup$ – user93353 Jan 15 '15 at 4:26
  • $\begingroup$ From that site, it looks like a library issue. If you're having coding issues, try posting on Stack Overflow; I would generally recommend avoiding SHA-1 for signatures, in case you end up with the attacker in control of part of the text you're signing. $\endgroup$ – cpast Jan 15 '15 at 5:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.