SHA-2 Encryption to Buildup an Eminent Website Security
Currently, the Internet security world is witnessing a revolutionary migration from SHA-1 algorithm to a safer option offered by it successor, SHA-2 algorithm. Internet security pundits across the world are predicting this migration to yield a better web security for all the users. Before getting into the nitty-gritty details about the SHA-2 migration, let’s take a quick look at the what and whys related to the SHA algorithms.
What is SHA?
Secure Hash Algorithm (SHA) was developed by US National Institute of Standards and Technology (NIST). It’s family consists of 4 algorithms namely, SHA-0, SHA-1, SHA-2 & SHA-3.
SHA is a type of cryptographic hash function, which is useful to ensure that the data is not modified. SHA does this by computing a cryptographic hash value that is unique to the given piece of data. This leads to the generation of different hash values for different data pieces. But, any kind of change to the data leads to a different hash value. Such differences in hash values help to determine any changes made to the data.
SHA-1: A Potential Victim
Designed by National Security Agency (NSA), SHA-1 was first published in 1995. It happens to be the most popular algorithm so far and is used in several important applications and protocols. However, in 2005, the discovery of its vulnerability towards attacks came as a first big blow to its popularity that was well-sustained for a decade.
As per the basic rule, a hashing algorithm can be considered safe till the time it produces unique output for any given input that cannot be reversed. And, experts found SHA-1 to be susceptible to the collision attacks. In such attacks, the attacker produces multiple outputs that render SHA-1 incapable of generating a message digest that is cryptographically secure. This was followed by several different attacks, which lead to an urgency to find a replacement for SHA-1 and start the migration.
SHA-2: A Collision Resistant Algorithm
Following the discovery of probable vulnerability towards collision attacks, SHA-1’s successor, SHA-2 was immediately nominated to be an apt algorithm to replace SHA-1. SHA-2 was found to be totally collision resistant. Here being ‘collision resistant’ doesn’t mean that there shall be no collision, it simply means that in this case, the collisions are hard to find.
Now, the collision occurs when two different files produce an identical hash. It then becomes possible to substitute a file for another. An attacker is capable of replacing it with a fraudulent certificate with same hash values. SHA-2 is found to be completely resistant to these attacks.
Although, SHA-1 has not been found to have become a victim of collision attack, but the ever-growing capacities of the computers shall soon make it a harsh reality for all the users. So, to avoid a catastrophic event in future, experts have rightfully suggested the SHA-1 SSL certificate users migrate to the SHA-2 algorithm.
Industry Support for SHA-1 Migration
Various important factors, such as PCI standards compliance, NIST guidelines etc are speeding up the process of SHA-2 migration. And the recent bouts of acceleration are caused by Deprecation Policies coming from several big names in the IT industry.
Google Chrome:
This is how the deprecation policies by the Search Engine Giant shall be affecting all the users of its web browser, Chrome:
November 3 2014
| Chrome Version | Beta Release Date | SHA-1 Expires (Jan-May 2016) | SHA-1 Expires (June-Dec 2016) | SHA-1 Expires (After 2016) |
| 39 | No Warning, 2014, ayed | No Warning Displayed | Secure, with minor Errors | |
| 40 | December 15 2014 | No Warning Displayed | Secure, with minor Errors | Neutral, lacking security |
| 41 | January 26 2015 | Secure, with minor Errors | Secure, with minor Errors | Affirmatively Insecure |
The visual cues for these warnings are as follows:
Secure, with Minor Errors – 
Neutral, lacking Security – 
Affirmatively Insecure – 
Mozilla Firefox:
Mozilla shall implement security warnings on their browsers for the websites relying on SHA-1 SSL certificates. Following are the dates:
January 1 2016 – Any SHA-1 certificate issued after this date shall trigger an error message of “Untrusted Connection”, as shown below.
January 1 2017 – Error message of “Untrusted Connection” shall be displayed for ALL SHA-1 certificates.
However, Mozilla stated that the company may implement more UI indicators later. So, users should look forward to more announcements and updates from Mozilla on this front.
Microsoft: Internet Explorer
In November 2013, Microsoft announced new policies for the Certificate Authorities (CAs) showing its support for SHA-1 deprecation. Their SHA-2 favoring time-line is depicted in the table below:
| Date | |
| January 1 2016 | CAs are not to issue any new SHA-1 SSL certificates and Code Signing certificates |
| January 1 2016 | No Code Signing certificates without time-stamp shall be accepted by Windows |
| January 1 2017 | No SHA-1 end entity certificates will be accepted by Microsoft |
PCI Compliance: As per the updated federal and PCI compliance standards, they might need their clients to use SHA-2 SSL certificates. The PCI network scanners shall fail a compliance audit upon finding SHA-1 SSL certificates.
NIST Guidance – As per their policies on hash functions, federal agencies should discontinue using SHA-1 SSL certificates for any applications. The US NIST guidance has counseled that, after January 2014, SHA-1 SSL certificates should not be trusted for any higher level of assurance communications over the US Federal Bridge PKI.
Looking at these deprecation policies, it becomes apparent how the SHA-2 migration will enhance the overall web security. As we all know, the strength of any certificate signature directly depends on the strength of the hashing function, which is used to produce it. SHA-1 hashing algorithm, still used in many SSL certificates, is found highly vulnerable to cyber attacks. Therefore, it is advisable to migrate from the weak SHA-1 SSL certificate to a stronger and more secure SHA-2 algorithm.
