New research has heightened an already urgent call to abandon SHA-1, a cryptographic algorithm still used in many popular online services. A new, powerful GPG collision attack on the system which could enable attackers to fake digital certificates has been discovered. . In a paper called SHA-1 is a Shambles , researchers Gaëtan Leurent and Thomas Peyrin have demonstrated a new, powerful attack on the system that could enable attackers to fake digital certificates for as little as $45,000. Leurent, from INRIA in France, and Peyrin, from the Nanyan Technological University in Singapore, demonstrated their attack by creating a fake digital certificate using the GNU Privacy Guard (GPG or GnuPG) system. The link for this article located at Naked Security is no longer available. . Recent analyses underscore the urgent need to eliminate SHA-1, given that GPG collision exploits allow for the creation of fraudulent digital certificates.. GPG Attack, SHA-1 Security Risks, Cryptographic Analysis, Digital Certificate Issues. . LinuxSecurity.com Team
Get the latest Linux and open source security news straight to your inbox.