Frederick Cheung wrote: > Nope. SHA1 is a digest function, not an encryption function and thus > inherently one-way only (at least that's what it's aiming for). If you > do find a way, a number of crypto researchers would be very interested > to find out how > Fred I heard recently that MD5 has started to show some weakness, which actually has allowed an old root certificate to be forged. As I heard it they used a cluster of 200 PlayStation 3 systems, which took about two weeks to find a usable collision on a MD5 hash allowing them to produce the forged SSL certificate.
It's really bad when a cryptographic hash can be reversed. However, it is my understanding that there are no known weaknesses in the SHA hash algorithms so SHA1 signed certificates are still perfectly safe (for now). -- Posted via http://www.ruby-forum.com/. --~--~---------~--~----~------------~-------~--~----~ You received this message because you are subscribed to the Google Groups "Ruby on Rails: Talk" group. To post to this group, send email to [email protected] To unsubscribe from this group, send email to [email protected] For more options, visit this group at http://groups.google.com/group/rubyonrails-talk?hl=en -~----------~----~----~----~------~----~------~--~---
