Skip to Content.
Sympa Menu

assurance - Re: [Assurance] SHA-2 Update

Subject: Assurance

List archive

Re: [Assurance] SHA-2 Update


Chronological Thread 
  • From: Ann West <>
  • To: "" <>
  • Subject: Re: [Assurance] SHA-2 Update
  • Date: Thu, 5 Sep 2013 20:42:58 +0000
  • Accept-language: en-US

Hence your concern of the matter. ;)

Thanks for asking about this, Dave.

From: David Langenberg <>
Reply-To: "" <>
Date: Thursday, September 5, 2013 4:39 PM
To: "" <>
Subject: Re: [Assurance] SHA-2 Update

Heh, I could've told you we'd fail that test miserably.  IIRC only the most recent release of RHEL had the proper openssl libs in place to handle SHA-2.  In our implementation just about every unix machine that needed to have "Protected Channels" got it's own custom build of OpenSSL installed.

Dave


On Thu, Sep 5, 2013 at 2:22 PM, Ann West <> wrote:
Per our Assurance call yesterday, below is an update on the SHA-2 issue.  

The InCommon Assurance Advisory and Technical Advisory Committees are investigating state of SP support of SHA 256 per the NIST requirement which calls for discontinuing use of the SHA-1 digest function or hash algorithm in digital signatures effective January 1, 2014 and recommends using any of the digest functions known collectively as SHA-2 for use in digital signatures. For initial background and early thoughts on the issue, see: https://spaces.internet2.edu/display/InCAssurance/Transition+to+SHA-2 

Tom Scavo, InCommon Ops, is working with Tom Barton of the AAC/TAC and  several campus testers to probe federation SPs. (For investigation methodology, see:

The campuses  testers include:
  • University of Iowa
  • Virginia Tech
  • UW-Milwaukee
  • University of Nebraska
Given early results, the TAC observed that the majority of outright failures come from three organizations:

1. Carnegie Mellon (30)
2. University of Chicago (21)
3. Highwire Press (19)

Further testing demonstrated a direct link between older versions of openssl and SHA-2 incompatibility. Tom is  now refining his script to iterate over all SP and their endpoints to allow deeper probing. Stay tuned for final outcomes and recommendations. 

Ann West
Assistant Director,
InCommon Assurance and Community
Internet2 based at Michigan Tech
 



--
David Langenberg
Identity & Access Management
The University of Chicago



Archive powered by MHonArc 2.6.16.

Top of Page