[telecom] Hoping to avert "collision" with disaster, Microsoft retires SHA1

open original image

Hoping to avert "collision" with disaster, Microsoft retires SHA1

After 2016, Microsoft will stop accepting the collision-prone crypto algorithm.

by Dan Goodin Nov 12 2013 Ars Technica

Microsoft is retiring two widely used cryptographic technologies that are growing increasingly vulnerable to attacks that seemed unlikely just a decade ago.

The company's software will stop recognizing the validity of digital certificates that use the SHA1 cryptographic algorithm after 2016, officials said on Tuesday. SHA1 is widely used to underpin secure socket layer (SSL) and transport layer security (TLS) certificates that authenticate websites and encrypt traffic passing between their servers and end users. SHA1-based certificates are also used to digitally verify that specific software applications are legitimate and not imposter programs or programs that have been tampered with to include hidden backdoors.

..