Effective January 1, 2016, Windows (version 7 and higher) and Windows Server will no longer trust any code that is signed with a SHA-1 code signing certificate and that contains a timestamp value greater than January 1, 2016
Does this mean:
- that executables (drivers etc.) signed using a certificate whose "Signature hash algorithm" is sha1 won't be trusted?
- that executables (drivers etc.) signed using sha1 as the "Digest algorithm" signature won't be trusted (even if the "Signature hash algorithm" of the certificate used is sha256)?
- Both?
- Something completly different?
Note: I used terminology as it is in Windows.
Second questions is about this part in the link provided above:
Code signature File Hashes: Microsoft does not require these file hashes to be done using SHA-2. Windows will also not enforce policies on these hashes. If pre-image attacks on SHA-1 become feasible we will reevaluate how the system trusts signatures made with such file hashes.
What exactly is ment by "Code signature File Hashes"?
Thanks.