Server gated cryptography
Server Gated Cryptography (SGC) is a defunct mechanism that was used to step up from 40-bit or 56-bit to 128-bit cipher suites with SSL/TLS. It was created in response to United States federal legislation on the export of strong cryptography in the 1990s.
The legislation had limited encryption to weak algorithms and shorter key lengths in software exported outside of the United States of America. When the legislation added an exception for financial transactions, SGC was created as an extension to SSL with the certificates being restricted to financial organisations.
This legislation changed, resulting in vendors no longer shipping export grade browsers and SGC certificates becoming available without restriction.
Today, SGC certificates are obsolete. "Export grade" browsers are unusable on the modern Web due to many servers disabling export cipher suites. Additionally, these browsers are incapable of using SHA-2 family signature hash algorithms like SHA-256. Certification authorities are phasing out the new issuance of certificates with the older SHA-1 signature hash algorithm which will cease the issuance of SGC certificates going forward.
The continuing use of SGC facilitates the use of obsolete, insecure Web browsers with HTTPS. However, while certificates that use the SHA-1 signature hash algorithm remain available, some certificate authorities continue to issue SGC certificates (often charging a premium for them) despite the fact they are obsolete. The reason certificate authorities can charge a premium for SGC certificates is that browsers only allowed a limited number of roots to support SGC.
When an SSL handshake takes place, the software (e.g. a web browser) would list the ciphers that it supports. Although the weaker exported browsers would only include weaker ciphers in its initial SSL handshake, the browser did also contain stronger cryptography algorithms. There are actually two protocols involved to activate them. Netscape used Step-Up, which used the now obsolete insecure renegotiation to change to a stronger cipher suite. Microsoft used SGC which aborts the handshake and restarts from the beginning with a new ClientHello message listing the stronger cipher suites, and also supported Netscape Step-Up for compatibility.
- Thawte SGC Knowledgebase, 3/12/2010
- University of Cambridge page on Server Gated Cryptography, 3/12/2010
- SSLShopper.com "Say No to SGC", 3/12/2010
- Server-Gated Cryptography (SGC) browsers pose security risks, 3/12/2010