Exemplar of Cryptography Vulnerabilities

1. Exemplar of Cryptography Vulnerabilities

2. Certificate validity is to long
Consequences
If attackers can obtain the associated private key, they can impersonate the entity named in the certificate.
Explanation
The longer a certificate is in use, the greater the chance that attackers will be able to obtain the associated private key
Vulnerability
64.1
X.509 certificate at /etc/ssl/certs/ca-certificates.crt with more than 3650 days

3. Use of SHA-1 Hash Function
SHA-1 is no longer considered secure
Consequences
Depends on the usage of the function, but generally, collisions in the hash function could lead to the hash payload being accepted as legitimate
when it has been altered.
Explanation
The first public full SHA-1 collision was announced in February 2017. SHA-1 should therefore be considered insecure for creating digests of
messages, code, certificates etc.
Expertise required
High to generate a new collision, but low to use the public collision, which allows two more or less arbitrary PDF files to be created with the
samedigest.
Access required
Depends on the usage of the function, but typically the attack involves substituting a valid artefact (e.g. a document, a protocol transcript, a
message, a code update) for a tampered one with the same hash
Resources required
Varies depending on the attack. Using the existing public collision is trivial. Currently, the best known algorithm for generating new chosen-
prefix collisions requires 2^77 hash calls, while common-prefix collisions require 2^61 calls.