SHA1指纹用于Azure IoT Hub/DPS设备公钥校验是否安全？为何不升级SHA256？

Let's break down your questions clearly, since this touches on both cryptographic practicality and real-world cloud service tradeoffs:

Is SHA1-based public key fingerprint verification still feasible? #

First, let's ground this in what SHA1's actual vulnerabilities mean for this specific use case:

• SHA1 is indeed known to be vulnerable to collision attacks, where an attacker can generate two distinct inputs that produce the same SHA1 hash. But this attack applies to arbitrary byte streams—not specifically to valid public keys, which have strict mathematical structures (like RSA keys requiring a valid modulus and exponent that meet number-theoretic rules).
• To forge a public key that matches the SHA1 fingerprint stored in IoT Hub/DPS, an attacker would need to create a cryptographically valid public key whose SHA1 hash exactly matches the target fingerprint. As of today, there are no publicly documented, practical attacks that can pull this off. Existing SHA1 collision techniques don't account for the constraints of valid public key formats, making this type of forgery extremely difficult (if not computationally infeasible) with current hardware.
• So while SHA1 is no longer considered secure for general-purpose hashing, its use for public key fingerprint verification in Azure IoT Hub/DPS remains viable in practice—there's no realistic path for an attacker to exploit the collision vulnerability here right now.

Why hasn't Azure upgraded to SHA256 by default? #

The decision to retain SHA1 support boils down to compatibility and gradual transition:

• Legacy device compatibility: A massive number of existing IoT devices were built with SHA1 fingerprint verification baked in. Forcing a hard switch to SHA256 would break connectivity for these devices, causing major disruption to users' IoT deployments. Azure prioritizes backward compatibility to avoid pushing customers into costly, time-consuming device updates or replacements.
• Dual support is already available: Azure actually does support SHA256 fingerprints for IoT Hub and DPS—SHA1 is maintained as a compatibility option, not the only choice. Customers can use SHA256 for new deployments, while existing devices can keep using SHA1.
• Risk vs. impact: While SHA1 has theoretical vulnerabilities, the practical risk of exploitation for public key fingerprinting is very low (as explained earlier). The business impact of breaking legacy devices far outweighs the current theoretical risk, so Azure has opted for a phased approach to encourage SHA256 adoption without forcing it.

内容的提问来源于stack exchange，提问作者datoga