Would SHA-1 be safe for certificates with short validity?

Question

There are articles floating around the topic of SHA-1 deprecation. The gist of it is that in (mostly) developing countries, people are still using mobile/computing devices that are 5 years old (or older) and do not support SHA-2. As a consequence, the deprecation of SHA-1 would result in their being "cut off from the Internet as we know it."

Yeah, there are many problems with this oversimplification, but here's some questions:

1. There are estimates that it would cost something in the ballpark of several hundred thousand US dollars to create a SHA-1 collision. But how much time does that take?

2. Depending on the answer to the first question, why not extend client and CA support for SHA-1, provided that certificate validity periods are simply shortened to 6 months? 3 months? One? This seems especially more feasible with the kind of automation LetsEncrypt offers.

In my view, there's nothing wrong with the SHA-1 algorithm. No one has "broken" or is coming close to "breaking" the algorithm per se. It is just becoming computationally more feasible to overcome its cryptographic strength over the typical course of a certificate's validity period. So long as that's the case, although it may be no longer well suited for year-long (or multi-year) certificate validity periods, it's still technically safe to use in more limited applications. After all... all forms of encryption are about time, not about impenetrability.

Would this proposal sufficiently eliminate known risks to make SHA-1 safe to use on older devices?

Answer 1

The short answer is that no, the length of validity would not help in a major way.

First you have to consider how the attack on the collision resistance of SHA-1 applies to certificates. The idea, and how it actually worked in the case of MD5, is basically:

1. Attacker finds a collision in the hash function that generates two certificates with the same hash.
2. They give¹ the innocent one to a CA for signing.
3. Now they also have a signature for the malicious one, that e.g. allows them to claim to be Google.

A validity period of months would still allow them to make use of it for months. That may be less of a return for the attacker's resources than using it for years, but you would expect such an attack to eventually be exposed anyway. And if, like poncho mentions in the comment, the attacker can generate a malicious certificate with a different period of validity, then even that is not an issue.

Now, if you think that in the next year or so no-one will be able to generate a collision due to the expense or time it takes, then you can argue that certificates should be allowed for an extra year. However, the validity period itself does not really matter in this case.

---

_{¹ Actually, the CA typically generates the certificate and the attacker must predict how and choose the information they give.}