Firebase uses insecure CC_SHA1 hash algorithm

[ssavchenko]

[READ] Step 1: Are you in the right place?

Yes

[REQUIRED] Step 2: Describe your environment

• Xcode version: 11.2.1
• Firebase SDK version: 6.13.0
• Firebase Component: FirebaseInstanceID
• Component version: 6.13.0

[REQUIRED] Step 3: Describe the problem

Method

NSData *FIRInstanceIDSHA1(NSData *data)

in FIRInstanceIDKeyPairUtilities.m

uses insecure CC_SHA1 hashing algorithm, while Apple officially considers this algorithm insecure. They state in iOS 13 CryptoKit documentation:

"This hash algorithm isn't considered cryptographically secure, but is provided for backward compatibility with older services that require it. For new services, prefer one of the secure hashes, like SHA512."

[charlotteliang]

Thank you for bringing to our attention. FIRInstanceIDSHA1 is NOT used for cryptographic purpose for any encryption or decryption. We use this hash method on a public key string to generate a random unique string for instanceID. Firebase does not use this hash method or this public/private key string for any encryption or decryption of our secret data.

We will kick out PR soon to clarify the naming of our method to avoid more confusions. Thanks!