Linux 7.0 Drops SHA-1 Module Signing Support

The Linux 7.0 kernel has officially removed support for signing kernel modules using SHA-1, marking the end of an era for the once-ubiquitous hashing algorithm. The change, merged without issue into the mainline kernel, reflects the cryptographic community's long-standing concerns about SHA-1's security vulnerabilities.

The End of SHA-1 in the Kernel

SHA-1 (Secure Hash Algorithm 1) has been a cornerstone of digital security for decades, but its weaknesses have been known for years. The algorithm's vulnerability to hash collisions—where two different inputs produce the same hash output—has made it unsuitable for security-critical applications like kernel module signing.

The Linux kernel has been gradually phasing out SHA-1 support. The kernel had already defaulted to SHA-512 for module signing since version 6.11, and major Linux distributions had stopped using SHA-1 signatures months ago. This latest change simply removes the code paths that would have allowed new modules to be signed with SHA-1.

What This Means for Users

Existing SHA-1 signed modules can still be loaded on Linux 7.0 systems, so this change won't break compatibility with older drivers or modules. However, developers and hardware vendors will need to ensure their kernel modules are signed using more secure algorithms like SHA-256 or SHA-512 going forward.

This transition is particularly important for enterprise environments and hardware manufacturers who rely on kernel module signing for security and compliance. The move to stronger hashing algorithms provides better protection against potential attacks that could exploit SHA-1's vulnerabilities.

The Broader Context

Linux's decision to drop SHA-1 support aligns with broader industry trends. Major web browsers stopped supporting SHA-1 SSL certificates years ago, and most modern cryptographic systems have long since moved to more secure alternatives.

The kernel module signing system, introduced to prevent loading of unauthorized or malicious kernel code, requires robust cryptographic foundations. SHA-512, which has been the default since 6.11, offers significantly better security properties and is computationally infeasible to break with current technology.

Looking Ahead

With SHA-1's removal from the kernel, Linux continues its tradition of prioritizing security and staying current with cryptographic best practices. This change, while technical in nature, represents an important step in maintaining the kernel's security posture as computing systems face increasingly sophisticated threats.

For most users, this change will be invisible—their systems were likely already using stronger signing algorithms. But for kernel developers and system administrators, it's a reminder of the ongoing need to keep security practices current and to phase out outdated cryptographic primitives before they become liabilities.

The Linux 7.0 kernel, with this change and others, demonstrates the project's commitment to security and its willingness to make difficult decisions about removing legacy support when it no longer meets modern security standards.