Author Topic: Windows 7 and Server 2008 Updates to Require SHA-2 Support Starting July  (Read 440 times)

Offline javajolt

  • Administrator
  • Hero Member
  • *****
  • Posts: 35126
  • Gender: Male
  • I Do Windows
    • windows10newsinfo.com
Microsoft announced on its support website that future Windows 7 and Windows Server 2008 updates will require SHA-2 code signing support to be installed starting with July 16, 2019.

SHA-2 code signing support will be added to Windows 7 SP1 and Windows Server 2008 R2 SP1 on March 12 and April 9 respectively, as part of dedicated standalone security updates.

While Windows updates are currently using both the SHA-1 and SHA-2 hash algorithms for codesigning purposes, migration to the SHA-2 is necessary because of the SHA-1 algorithm becoming impacted by a number of weaknesses that made it less secure over the years.

According to Microsoft's support article:

Quote
To protect your security, Windows operating system updates are dual-signed using both the SHA-1 and SHA-2 hash algorithms to authenticate that updates come directly from Microsoft and were not tampered with during delivery. Due to weaknesses in the SHA-1 algorithm and to align to industry standards Microsoft will only sign Windows updates using the more secure SHA-2 algorithm exclusively.

Microsoft also advises customers who use Windows Server Update Services (WSUS) 3.0 SP2 to update their servers with the SHA2 updates for WSUS 3.0 SP2 until June 18 to make sure that they can deliver future SHA2-signed updates to their enterprise environment.

Windows Server Update Services (which was previously known as Software Update Services) is a program designed to allow Windows administrators to manage update and hotfix distribution to stations in a corporate environment.

The full schedule for the SHA-2 code signing support migration process can be found in the table below, however, the dates are subjects to change according to Microsoft:





source