SHA-1 – Would using a SHA-1 CSR be a risk?

Question

If someone would generate a SHA1 CSR and submit it to an CA to receive a SHA2 certificate, would the process as a whole be at risk because the CSR could be malicious?

Assumption:

In this case, the “data” (as used in Q2) is the public key of the end user certificate. In practice the CA could still generate a SHA2 certificate, even when a SHA1 CSR is being submitted. However, the CSR itself would be vulnerable in theory. So if an attacker would get in between he could put another name on the certificate. However, a proper RA would validate the CN and discover the forgery.

So basically a collision at the CSR would be possible but the validation process around it would keep it safe. However, submitting a SHA-2 CSR would be safer.

Would this even be a real life attack scenario?

Answer 1

No, it is not. The SHA-1 attack requires pre-computation. It is basically not possible to get a hash collision for data that is not controlled by the attacker. You'd need the attacker and the submitter of the certificate signing request to cooperate to create two different CSR's that have the same hash value within the signature calculation / verification.

Even then, it makes no sense to do this. As you correctly identified the RA would validate the CN. So you would not have achieved anything (if the wrong CN is accepted then the RA code itself is at risk, and this would have nothing to do with the certificate request itself).

It may be good to note that the main reason for signing the CSR is for the CA to validate that the entity filing the request and the entity holding the private key are the same entity.

Regardless, using SHA-2 for CSR's should of course be preferred over using a broken hash such as SHA-1.