SHA-1 times tamped in 2016
Happy New Year!
The official SHA-1 statement is/was: "For code signing certificates, Windows
will stop accepting SHA-1 signed code and SHA1 certificates that are time
stamped after 1 January 2016. SHA-1 signed code time stamped by an RFC 3161
Time Stamp Authority before 1 January 2016 will be accepted until such time
when Microsoft decides SHA-1 is vulnerable to pre-image attack."
Just for fun, I have used my old SHA-1 code-signing certificate and code
signed and time stamped a setup.exe on January 02, 2016. Result: it's still
accepted on my Win10 and Win7 test machines.
Let's see what will happen next week.
Friedrich
Reply With Quote