New attack produces quicker SHA-1 collisions

From The H Security Australian researchers have described a new and faster way of provoking collisions of the SHA-1 hash algorithm. With their method, a collision can be found using only 252 attempts. This makes practical attacks feasible and could have an impact on the medium-term use of the...

SSL Certificate Signed Using Weak Hashing Algorithm

The remote service uses an SSL certificate chain that has been signed using a cryptographically weak hashing algorithm e.g. MD2, MD4, MD5, or SHA1. These signature algorithms are known to be vulnerable to collision attacks. An attacker can exploit this to generate another certificate with the sam...

SSL Certificate Information

This plugin connects to every SSL-related port and attempts to extract and dump the X.509 certificate. TRUSTED...

EEYE: McAfee ePolicy Orchestrator Remote Compromise

McAfee ePolicy Orchestrator Remote Compromise Release Date: July 13, 2006 Severity: High Remote Code Execution Vendor: McAfee Systems Affected: McAfee Common Management EPO Agent versions below version 3.5.5.438 Overview: McAfee ePolicy Orchestrator is the remote security management software for...

Ubuntu 4.10 / 5.04 : openssl weak default configuration (USN-179-1)

The current default algorithm for creating 'message digests' electronic signatures for certificates created by openssl is MD5. However, this algorithm is not deemed secure any more, and some practical attacks have been demonstrated which could allow an attacker to forge certificates with a valid...

APPLE-SA-2006-01-05 AirPort firmware update

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 APPLE-SA-2006-01-05 AirPort firmware update The following AirPort firmware updates are available: AirPort Express Firmware Update 6.3 for Mac OS X AirPort Express Firmware Update 6.3 for Windows AirPort Extreme Firmware Update 5.7 for Mac OS X AirPort...

Mandrake Linux Security Advisory : openssl (MDKSA-2005:179)

Yutaka Oiwa discovered vulnerability potentially affects applications that use the SSL/TLS server implementation provided by OpenSSL. Such applications are affected if they use the option SSLOPMSIESSLV2RSAPADDING. This option is implied by use of SSLOPALL, which is intended to work around various...

USN-179-1: openssl weak default configuration

The current default algorithm for creating "message digests" electronic signatures for certificates created by openssl is MD5. However, this algorithm is not deemed secure any more, and some practical attacks have been demonstrated which could allow an attacker to forge certificates with a valid...

SHA family hash functions cryptographic weakness

Cryptographic weakness found making real strength against coliisions: collisions in the the full SHA-1 in 269 hash operations, much less than the brute-force attack of 280 operations based on the hash length. Collisions in SHA-0 in 239 operations. Collisions in 58-round SHA-1 in 233 operations...

SHA-1 Broken

HA-1 Broken SHA-1 has been broken. Not a reduced-round version. Not a simplified version. The real thing. The research team of Xiaoyun Wang, Yiqun Lisa Yin, and Hongbo Yu mostly from Shandong University in China have been quietly circulating a paper describing their results: collisions in the the...