Assurance

[David Langenberg <>]

Heh, I could've told you we'd fail that test miserably.  IIRC only the most recent release of RHEL had the proper openssl libs in place to handle SHA-2.  In our implementation just about every unix machine that needed to have "Protected Channels" got it's own custom build of OpenSSL installed.

Dave

On Thu, Sep 5, 2013 at 2:22 PM, Ann West <> wrote:

Per our Assurance call yesterday, below is an update on the SHA-2 issue.  

The InCommon Assurance Advisory and Technical Advisory Committees are investigating state of SP support of SHA 256 per the NIST requirement which calls for discontinuing use of the SHA-1 digest function or hash algorithm in digital signatures effective January 1, 2014 and recommends using any of the digest functions known collectively as SHA-2 for use in digital signatures. For initial background and early thoughts on the issue, see: https://spaces.internet2.edu/display/InCAssurance/Transition+to+SHA-2 

Tom Scavo, InCommon Ops, is working with Tom Barton of the AAC/TAC and  several campus testers to probe federation SPs. (For investigation methodology, see:

https://spaces.internet2.edu/display/InCAssurance/Testing+for+SHA-2+Compatibility )

The campuses  testers include:

• University of Iowa
• Virginia Tech
• UW-Milwaukee
• University of Nebraska

Given early results, the TAC observed that the majority of outright failures come from three organizations:

1. Carnegie Mellon (30)

2. University of Chicago (21)

3. Highwire Press (19)

Further testing demonstrated a direct link between older versions of openssl and SHA-2 incompatibility. Tom is  now refining his script to iterate over all SP and their endpoints to allow deeper probing. Stay tuned for final outcomes and recommendations. 

Ann West

Assistant Director,

InCommon Assurance and Community

Internet2 based at Michigan Tech

 

office: +1.906.487.1726 

--
David Langenberg

Identity & Access Management

The University of Chicago