Several months ago, online digital security news outlets announced that SHA-1 has function was broken by CWI Amsterdam and Google.

What does it mean for your PDF documents? Let’s review basics and steps you need to do.

A bit of background

SHA-1 (Secure Hash Algorithm 1) is a cryptographic hash function designed by the United States NSA and is a U.S. Federal Information Processing Standard and first published in 1995 (link). SHA-1 produces a 160-bit (20-byte) hash value known as a message digest.

Those secure hash algorithms (including SHA-1) are a cryptographer’s swiss army knife. They are used everywhere: from browser security, to online e-commerce, to detecting duplicate files in storage, to security in PDF documents.

The Announcement

On February 23, 2017, CWI Institute in Amsterdam and Google announced that they generated a hash collision. As a proof of the attack, they released two PDFs that have identical SHA-1 hashes but different content.

What system are affected?

Many applications that rely on SHA-1 for digital signatures, file integrity, or file identification is potentially vulnerable. These include:

• Digital Certificate signatures
• Email PGP/GPG signatures
• Software vendor signatures
• Software updates
•  ISO checksums
• Deduplication systems
• … and many others

How is it related to PDF documents and forms?

SHA256 has been the default hashing algorithm in Acrobat since version 9.1. However, in some cases, for example if the signature device (like a smart card or USB token) or its driver doesn’t support SHA256 hashing, to prevent failure while creating the signature, Acrobat or Reader still can fall back to use SHA1.

With Acrobat DC and Acrobat Reader DC release 2017.009.20044, Adobe is warning users against using the deprecated SHA1 hash algorithm for digital signatures.

Moving forward with safer options

This announcement is a clear sign that you need to migrate from SHA-1 to safer cryptographic hashes such as SHA-256 and SHA-3. Furthermore, Google has provided a free detection system to the public.

Also, a good sign you should take note that ISO 32000-2 (PDF 2.0) deprecates SHA-1. PDF 2.0, which has been (mostly) final for a year now, is in its final editing phase now, and is expected before summer.

PDF forms in PDF Share Forms

We also put security first. PDFSF Cloud and PDFSF Informational Worker have hash algorithms for digital signatures to SHA 256 or better. SHA-1 is not an option. Your PDF documents are safe with PDF Share Forms.