Deprecating MD5 and SHA-1 Signature Hashes in TLS 1.2 and DTLS 1.2
updates
- rfc-5246 — The Transport Layer Security (TLS) Protocol Version 1.2
Extracted elements (12)
MD5 and SHA-1 are deprecated for TLS 1.2 digital signatures because collision attacks against both algorithms have been proven practical: NIST disallowed SHA-1 for digital signatures after 2013, transcript collision attacks on TLS were identified in 2016, and full SHA-1 collisions were demonstrated in 2017 by Google and CWI Amsterdam.
SHA-1 with HMAC as used in TLS record protection is explicitly not deprecated by this document; the deprecation applies only to digital signatures. The HMAC construction provides a distinct security profile from bare SHA-1 hashing used for signing.
This document updates RFC 5246 (TLS 1.2) to prohibit MD5 and SHA-1 in digital signatures. Implementations that previously negotiated these hash algorithms based on RFC 5246 behavior must be updated to comply with these stricter requirements.
Clients MUST include the signature_algorithms extension in TLS 1.2 ClientHello messages. Clients MUST NOT include MD5 and SHA-1 in this extension.
Clients MUST NOT include MD5 and SHA-1 in CertificateVerify messages.
If a client receives a ServerKeyExchange message indicating MD5 or SHA-1 as the signature hash, it MUST abort the connection with an illegal_parameter alert.
If a server receives a CertificateVerify message with MD5 or SHA-1, it MUST abort the connection with an illegal_parameter alert.
Servers MUST NOT include MD5 and SHA-1 in ServerKeyExchange messages.
Servers SHOULD NOT include MD5 and SHA-1 in CertificateRequest messages.
IANA updated the references for the TLS SignatureAlgorithm and TLS HashAlgorithm registries to include RFC 9155 in addition to RFCs 5246 and 8447.
IANA updated the TLS SignatureScheme registry by changing the recommended status of rsa_pkcs1_sha1 (0x0201) and ecdsa_sha1 (0x0203) to 'N' (not recommended), referencing both RFC 8446 and RFC 9155.
Concerns exist with TLS 1.2 implementations falling back to SHA-1 signatures. This document deprecates MD5 and SHA-1 for digital signatures in TLS 1.2 and DTLS 1.2 to address those concerns.