Could you elaborate, exactly how weak hash could matter for self-signed certificate? Without vague references like "if you don't want to trust the NSA and NIST". I do not see any of those organisations stating that weak hash is dangerous for a situation where signature itself is irrelevant.
On Fri, Feb 02, 2018 at 03:44:02PM -0600, R0b0t1 wrote: > > The signature is not entirely irrelevant, and a weak digest on a root > CA does make it easier (but perhaps not yet feasible) to attack the > root CA. More problematic is an attack on an intermediate CA due to > certificates using a weak digest. > > https://csrc.nist.gov/publications/detail/sp/800-131a/archive/2011-01-13 > > "SHA-1 shouldn't be trusted past January 2016 because of the > increasing practicality that a well-funded attacker or government > could find a SHA-1 hash collision, allowing them to impersonate any > SSL website." (Paraphrased.) > > If you still don't want to trust the NSA and NIST, I think the test is > accurate: They're using old technology that needs to be updated. It's > too bad that that is work, so I suppose it's a good thing you're > getting paid. _______________________________________________ Openvas-discuss mailing list [email protected] https://lists.wald.intevation.org/cgi-bin/mailman/listinfo/openvas-discuss
