After Google's collision attack, is RSA-SHA1 signature still safe? Google succeeded to get a collision in SHA-1 last year in an attack called shattered. Does this fact make certificates based RSA-SHA1 Signature risky for  creating fraud certificates?

If RSA-SHA1 signature is still safe, why is that (because the attacker doesn't have the private key)?
The answer is "not safe".

But it is not safe, regardless of Google's attack. Before Google attacked, we knew that SHA-1 is not the best choice. 

Google found one collision based on some existing, publicly known collision 
attacks on SHA-1. Sees the introduction of Google's paper for a complete list of prior work.



First, let me briefly explain how RSA-SHA1 signature works. The explanation below is adapted from a W3C's page introducing RSA-SHA1.


The message $m$ is compressed via SHA-1 into a fixed-length string $h=\mathsf{SHA1}(m)$.
The RSA signature scheme (with padding via PKCS#1) creates a signature on $h$ rather than $m$. $\sigma=\mathsf{RSASignPKCS\#1}_\mathsf{sk}(h)$.


If SHA-1 is fully broken, we expect that we can find $m_1$ and $m_2$ with the same hash value under possible resource constriant: $\mathsf{SHA1}(m_1)=\mathsf{SHA1}(m_2)$.

In this case, they have the same $h$. A RSA-SHA1 signature for $m_1$ is also a RSA-SHA1 signature for $m_2$.



Now I give an example of why it fails. (corrected example, thanks to @peter-green)

I am the website owner of randomwebsite.com.
I want to have VeriSign sign a certificate for cvs.com.

So, I use the collision attack to generate two certificates.


A certificate for randomwebsite.com.
A certificate for cvs.com.


These two certificates have the same hash.

I have a CA to sign the certificate for randomwebsite.com. 

Now, if you have randomwebsite.com's certificate signed by CA via RSA-SHA1, which has a signature for that hash. This signature can also be used in the certificate of cvs.com. 

You can apply the signature to the fake cvs.com certificate. Different from the real cvs.com certificate, for this one, you have the private key associated with the public key in the certificate.

A more detailed discussion can be found in another post.



A lesson from the SHA-1 story:


Always use the MOST advanced cryptography. We know SHA-1 has some problems and there is SHA-256, SHA-512 and others to replace it. There is no reason to sit in front of a tiger.




Some comments to this post are of great help.
Thanks to Joshua, Squeamish Ossifrage, and Peter Green.