Deprecating MD5 and SHA-1 Signature Hashes in TLS 1.2 and DTLS 1.2

Metadata

Publisher: IETF
Doc Type: Standard
Pages: 5
Abstract: The MD5 and SHA-1 hashing algorithms are increasingly vulnerable to attack, and this document deprecates their use in TLS 1.2 and DTLS 1.2 digital signatures. However, this document does not deprecate SHA-1 with Hashed Message Authentication Code (HMAC), as used in record protection. This document updates RFC 5246.
Publication Date: 2021-12-01
Status Note: Proposed Standard
DOI: 10.17487/RFC9155
Link: https://doi.org/10.17487/RFC9155
Author(s): Loganaden Velvindron
Kathleen Moriarty
Alessandro Ghedini
Keyword(s): TLS

Latest version of IETF RFC 9155

Document Versions — IETF RFC 9155

▶ IETF RFC 9155 (2021-12-01)

THIS DOC [ACTIVE] [LATEST VERSION]

Normative Reference(s)

IETF RFC 2119 [Active*]
IETF RFC 5246 [Superseded*]
IETF RFC 8174 [Active*]
IETF RFC 8446 [Superseded*]
IETF RFC 8447 [Active*]

Bibliographic Reference(s)

10.1007-11535218_2 — Wang EXTERNAL
10.14722-ndss.2016.23418 — SLOTH EXTERNAL
NIST.SP.800-131A — SP800-131 EXTERNAL
Stevens, M., Bursztein, E., Karpman, P., Albertini, A., and Y. Markov, "The First Collision for Full SHA-1", 2017, <https://eprint.iacr.org/2017/190>. EXTERNAL
CA/Browser Forum, "Ballot 118 -- SHA-1 Sunset (passed)", October 2014, <https://cabforum.org/2014/10/16/ballot-118-sha-1-sunset/>. EXTERNAL
IETF RFC 6151 [Active*]

Source Data (JSON)

Full registry record with provenance metadata. Open directly: /api/doc/RFC9155.json

Reference Tree

Explore all references and references to this document, as a navigable tree.

Open Reference Tree

Reference this Doc

Plain text (ISO 690 compliant)

Preview:

IETF RFC 9155, Deprecating MD5 and SHA-1 Signature Hashes in TLS 1.2 and DTLS 1.2. Available at https://doi.org/10.17487/RFC9155

Snippet:

IETF RFC 9155, Deprecating MD5 and SHA-1 Signature Hashes in TLS 1.2 and DTLS 1.2. Available at https://doi.org/10.17487/RFC9155

HTML (ISO 690 compliant)

Preview:

IETF RFC 9155, Deprecating MD5 and SHA-1 Signature Hashes in TLS 1.2 and DTLS 1.2. Available at https://doi.org/10.17487/RFC9155

Snippet:

<span class="citation"><cite>IETF RFC 9155</cite>, Deprecating MD5 and SHA-1 Signature Hashes in TLS 1.2 and DTLS 1.2. Available at <a href="https://doi.org/10.17487/RFC9155" target="_blank" rel="noopener">https://doi.org/10.17487/RFC9155</a></span>

SMPTE's HTML Pub

Preview:

IETF RFC 9155, Deprecating MD5 and SHA-1 Signature Hashes in TLS 1.2 and DTLS 1.2
doi: 10.17487/RFC9155
url: https://doi.org/10.17487/RFC9155

Snippet:

<li>
<cite id="bib-rfc9155">IETF RFC 9155</cite>, Deprecating MD5 and SHA-1 Signature Hashes in TLS 1.2 and DTLS 1.2
<span class="doi">10.17487/RFC9155</span>
</li>

Referenced By

IETF RFC 9190 [Active*]