Deprecation of SHA-1 Hashing Algorithm for Microsoft Root Certificate Program

[NewsArchive]

All,

Okay, here is the story. Microsoft has published a security advisory on
"Deprecation of SHA-1 Hashing Algorithm for Microsoft Root Certificate
Program". The new policy takes effect after January 1, 2016 and requires
CAs to migrate to the stronger SHA-2 hashing algorithm.

In summary, Windows will cease accepting SHA-1 certificates on January 1,
2017. To continue to work with Microsoft platforms, all SHA-1 SSL
certificates issued before or after this announcement must be replaced with
a SHA-256 (SHA-2) equivalent by January 1, 2017. Organizations need to
develop a migration plan for any SHA-1 end-entity SSL certificates that
expire after January 1, 2017 and SHA-1 code signing certificates that expire
after January 1, 2016. SHA1 code signing certificates that are time stamped
before 1 January 2016 will be accepted until such time when Microsoft
decides SHA1 is vulnerable to pre-image attack. Microsoft will give new
consideration to the SHA deprecation deadlines in July 2015.

1. Customers should "renew" with SHA-2 end-entity and intermediate
certificates.

2. Microsoft will cease trusting Code Signing Certificates using SHA-1 on
January 1, 2016.

Most applications, servers and browsers now support SHA-2, however some
older operating systems such as Windows XP prior to Service Pack 3, and some
mobile devices do not.

For example:
http://support.microsoft.com/kb/2763674

Before the SHA-1 algorithm is formally deprecated by Microsoft, it is
important to ensure your organization and those relying on your
infrastructure are benefiting from SHA-2 support by installing the latest
version of the application or browser and applying all known security
updates to your operating system.

Comodo will support only SHA-2 on all 3 year code signing certificates.
They will also confirm policies at this time regarding 2 year SHA-1 code
signing certificates.

http://www.comodo.com/e-commerce/SHA-2-transition.php

More SetupBuilder 8.x with built-in support for SHA-2 information to follow
soon.

Friedrich

--
Friedrich Linder
Lindersoft
www.lindersoft.com
+1.954.252.3910

--Helping You Build Better Installations
--SetupBuilder "point. click. ship"
--Create Windows 8 ready installations in minutes
--Official COMODO Code Signing and SSL Certificate Partner

[NewsArchive]

Excellent update, Friedrich! Thanks.

So apparently, when specifying a 3-year certificate I wouldn't have have
been able to select SHA-1.
I didn't think to try.
I was surprised by the option in the first place and just wanted to get the
purchase process started to I could go to bed.

When it says that XP prior to SP3 will not accept SHA-2... I wonder whether
that means *anything* signed with a SHA-2 certificate? or only if signtool
is told to use the longer hash (as shown in the latter pics in my PDF)... I
don't have a pre-SP3 VM to play with, and don't care enough to build one.

From the Comodo web page to which you link, there's also this paragraph:

"May 2014
Comodo will support automated, on-demand re-issuance of code-signing
certificates. Customers will be able to easily replace SHA-1 code-signing
certificates with SHA-2 versions by logging into their accounts. "

"May you live in interesting times....."

Jane

[NewsArchive]

Thanks. That certainly clears the air somewhat and plenty of time to
implement these changes.

Just so I'm clear, this is not for the code signing certs, only SSL
certs right?

--

Russ Eggen
RADFusion International, LLC

[NewsArchive]

So how would you translate this one statement:

> 2. Microsoft will cease trusting Code Signing Certificates using SHA-1 on
> January 1, 2016.

Darko

[NewsArchive]

Darko,

> So how would you translate this one statement:
>
>> 2. Microsoft will cease trusting Code Signing Certificates using SHA-1 on
>> January 1, 2016.

You can't code-sign application files and installers using SHA-1 on and
after January 1, 2016. In other words, you need a code-signing certificate
with SHA-2 support on and after January 1, 2016.

Plans are that all files which have been code-signed with SHA-1 and
timestamped (IMPORTANT!) before January 1, 2016 are still "valid". But
Microsoft will give new consideration to this in July 2015.

Friedrich

[NewsArchive]

Thanks, exactly as I understood myself for the first time, now repeat that to
Russ in previous post also <g>

Darko

[NewsArchive]

No need - I got it <g>

--

Russ Eggen
RADFusion International, LLC