Will Google block HMAC-SHA1 along with SHA1 signed certificates?

Due to the mathematics of how HMACs work, a weakness in the hash algorithm doesn't automatically mean that a HMAC based on it is also weak. This might seem counter-intuitive, but comes down to the fact that the known weakness in SHA1 relates to collisions, and can't be applied to a HMAC due to the construction method. In fact, even HMAC-MD5 is still fairly secure, even though MD5 is considered completely broken.

All this means that Google haven't made any indications of wanting to retire HMAC-SHA1 at the moment. They may want to in the future, especially if different forms of attack against SHA1 are found, but currently the only known way to break a HMAC-SHA1 is to brute force the key, which should, given a sensible key selection process, be really hard.


To complement @Matthew's point (which is very correct): HMAC's security is proven to be good, as long as the underlying hash function is built over an internal "compression function" that fulfils some specific properties. It is known that MD5 and SHA-1 do not fulfil all these properties (because then they would also be ideally resistant to collisions, which they are not), but that just invalidates the proof. It does not turn into an actual attack. Absence of a proof of security is not a proof of absence of security.

In SSL/TLS, HMAC is used in two places: for the integrity checks on records, and as part of the internal "PRF" which is used to derive keys into other keys. Up to and including TLS 1.1, HMAC/SHA-1 is used in both roles, and that's not optional. Banning HMAC/SHA-1 would really mean enforcing TLS-1.2. Right now, too many HTTPS servers still support only TLS-1.0, so Google cannot afford to prohibit pre-1.2 protocol versions. Web browsers gotta browse.