SHA-1 – Would using a SHA1 signature be a risk?

Question

If data (e.g. an e-mail, pdf file, xml content) is hashed using SHA-1 and then signed by a SHA-2 certificate, is this any bigger of a risk than using a SHA-2 hash with a SHA-2 certificate?

I assume in this scenario although the actual file content COULD be collided (as being hashed using SHA-1), in practice the risk is very small since the signature is made by a secure SHA-2 certificate.

In my question “SHA-1 – Why is it hard to find a certificate collision?” I stated colliding a certificate is harder than a PDF file. However, does this hold up for ANY kind of signed file? A certificate is basically a file with a signed hash. So what if I take a signed PDF? Or a signed e-mail? Would it still be hard to attack and why?

Answer 1

Yes, it is.

A chain is as strong as its weakest link. Strengthening one link, e.g. using a SHA-2 certificate instead of a SHA-1 certificate, will not strengthen any other link.

You cannot prevent someone tricking you into signing a SHA-1 collision, just by using a SHA-2 certificate. A SHA-2 certificate is a certificate that was signed using SHA-2 by the certificate authority that issued the certificate. Having such a certificate will not give you magic super powers. You will still have to use your own private/public key pair wisely.

Regarding the follow-up questions, you would of course have to generate the collision prior to signing it the first time. The second signature might be added in at least three different ways:

1. In parallel with the first signature, over the same data and consequently using the same hash. In this case you will obviously get a collision the second time as well.
2. Over the signed data including the first signature. It might be harder to generate an original collision that will still be collision for the second signer in this scenario. On the other hand, this doesn't matter unless the second signer gets the to-be-signed data with physical security directly from the first signer.
3. Counter signature of the first signature blob. Since the first signature blob is already compromised by a collision, the counter signature will by extension also be compromised.