Last Modified: Apr 28, 2025
Affected Product(s):
BIG-IP LTM
Known Affected Versions:
11.5.4, 11.5.4 HF1, 11.5.4 HF2, 11.6.0, 11.6.0 HF1, 11.6.0 HF2, 11.6.0 HF3, 11.6.0 HF4, 11.6.0 HF5, 11.6.0 HF6, 11.6.0 HF7, 11.6.0 HF8, 11.6.1, 11.6.1 HF1
Fixed In:
12.0.0, 11.6.1 HF2, 11.5.4 HF3
Opened: Mar 28, 2014 Severity: 3-Major
BIG-IP uses SHA1 in handshake signature, even though the client indicates support for stronger hash algorithms.
The updated code respects client signature_algorithms extension. If possible, BIG-IP now prefers SHA256 in the handshake signature based on the content of the signature_algorithms extension. BIG-IP further upgrades the hash algorithm to SHA384 from SHA256 when P-384 is used, e.g. when P-384 ECDSA X.509 certificate is used in the handshake. This additional enhancement only applies to the code base starting from 12.0; it was not ported to the 11.x code base. The signature_algorithms extension is defined in TLS 1.2. It's not not present in prior versions of the protocol. This logic attempts to avoid the use of SHA1 in TLS handshake, whenever possible. This change does not affect signatures used in X.509 certificates as these signatures are created by the X.509 CAs and not by BIG-IP. The only time SHA1 will be used in the handshake signature is when either of the following is true: - RSA key is used and the signature_algorithms extension is missing or - signature_algorithms is present and only lists SHA1. These conditions are expected to not hold for modern TLS clients, resulting in the upgrade to the SHA256 or better.
When BIG-IP acts as TLS server (applies to clientssl SSL Profile): - SSL Profile "SSL Sign Hash" set to ANY. The use of other choices is not recommended. - Client sends signature_algorithms extension that includes SHA256. - ECDSA X.509 certificate has additional logic. If the TLS client doesn't send signature_algorithms, BIG-IP will choose SHA256.
None
None
Respect client signature_algorithms extension. If possible, prefer SHA256 in handshake signature.