Important note about SSL VPN compatibility for 20.0 MR1 with EoL SFOS versions and UTM9 OS. Learn more in the release notes.

Thread Info
  • State Suggested Answer
  • Locked Locked
  • Replies 5 replies
  • Answers 2 answers
  • Subscribers 44 subscribers
  • Views 3237 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Sophos XG OTP - Why weak SHA-1 and low encryption length?

Nafets

XG550 (SFOS 19.0.2 MR-2-Build472)

This is specially directed to Sophos:

Hello SOPHOS,

i tried to import a Sophos XG created TOTP into Sophos UTM which is handling reverse proxy functionality with reverse auth including totp (because sophos xg is not able to do totp with reverse auth o.O )

I tried to import the token but UTM is sayin: 

Why there is no chance to change hash algorithm in XG?
Why the created TOTP tokens are that "weak"?

I am tired making comparison to utm but why is utm supporting SHA1, SHA256 and even SHA512 algorithmns for OTP and the NEWER, BETTER, MORE SECURE, undiscontinued product SOPHOS XG can not even handle this basic thing????

Please give me an explanation...

Kind regards,
Nafets



This thread was automatically locked due to age.
Parents Reply Children
  • 0 in reply to LuCar Toni

    Every auditor asks why the SHA1 (not collision free) is used while SHA2 is available.
    The buzzword is "Stand der Technik".
    Even if the BSI says that SHA1 is acceptable for OTP.
    We have to explain that every time.

    But after Sophos showed in the SG and sophos-authenticator that SHA2 works and SHA2 hardware tokens are available, it would be good to have that in the XG as well.


    Dirk

    Systema Gesellschaft für angewandte Datentechnik mbH  // Sophos Platinum Partner
    Sophos Solution Partner since 2003
    If a post solves your question, click the 'Verify Answer' link at this post.

Unfiltered HTML