oss-security - Microsoft Warns Customers Away From RC4 and SHA-1

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date: Wed, 13 Nov 2013 00:36:00 -0700
From: Kurt Seifried <kseifried@...hat.com>
To: Open Source Security <oss-security@...ts.openwall.com>
Subject: Microsoft Warns Customers Away From RC4 and SHA-1

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

- From Slashdot:

"The RC4 and SHA-1 algorithms have taken a lot of hits in recent
years, with new attacks popping up on a regular basis. Many security
experts and cryptographers have been recommending that vendors begin
phasing the two out, and Microsoft on Tuesday said it is now
recommending to developers that they deprecate RC4 and stop using the
SHA-1 hash algorithm. RC4 is among the older stream cipher suites in
use today, and there have been a number of practical attacks against
it, including plaintext-recovery attacks. The improvements in
computing power have made many of these attacks more feasible for
attackers, and so Microsoft is telling developers to drop RC4 from
their applications. The company also said that as of January 2016 it
will no longer will validate any code signing or root certificate that
uses SHA-1."

http://threatpost.com/microsoft-warns-customers-away-from-sha-1-and-rc4/102902

http://blogs.technet.com/b/srd/archive/2013/11/12/security-advisory-2868725-recommendation-to-disable-rc4.aspx

http://blogs.technet.com/b/srd/archive/2013/11/12/security-advisory-2880823-recommendation-to-discontinue-use-of-sha-1.aspx

I'm inclined to agree. The question I suppose is, like DES (and
3DES/MD5) at what point do we start assigning CVE's for some of this?
thoughts and comments welcome.

- -- 
Kurt Seifried Red Hat Security Response Team (SRT)
PGP: 0x5E267993 A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.15 (GNU/Linux)

iQIcBAEBAgAGBQJSgyvgAAoJEBYNRVNeJnmTrSIQAJs4xB656Th6dRpFKgIcipB8
HKeKt+fKYBV+a5njw3EXBVlDuQ8pbFhngMrPA0Ym5qSvgpTlRD0tSKIYB+nmnA2Q
nNby58VGGPfRrSaMFwLPS6Kt8p/vSXdyES/CkwHrN2uzUZ1IihuKs8p37pTgiM/U
QJK43tt1wRgSy/vIjiWatz1aeGtz/jXDpq3b+EInPsc9xmvnmchptmU6rZH/xtyu
nBadOwWiYOTqEAE2EZvoH1QQD2u/JQiWMnJf3MzFAnLus2CtdJO6Ol/1Y6lvDpw3
9W5994Tf00D90Rduerev8vugPgfDTHZJS8vpzLVHS4V4Sm5Lah2mWyFYrKLaIOQY
pzhofdLI2KWw9Ecjhj+z7FNsCr9goSbZILOKUrH0oVRoMtSH4a8V+MJLP1IQSpnN
ceOBo2ukJW+kSm6D0ZMDXOV/rmWfC4HEZIuhi8vxFXvSEGUgQaZzdd1JZK20iwPz
3BjGMqgrmcC8qUsXVraJfrG4NAWPUuB1L/I4qGLuqYo8L8NrLN0F0VApHP95kHn8
Q/iEHx+0+s/17D0KcjDgsR17A601oJjw4ku4CnXU9+sdlhdhERAKY70CZEBIcjPn
yPwtnq0w4l0lxcQb+qIi9C+fCx9xnBrhTLorLLkx2JUB5qk+QOKMi6tV0k6Hxr83
l+hmVlhruE4OctgTtNHp
=fAYL
-----END PGP SIGNATURE-----

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.