Re: netpgp and SHA1-PGP stuff

--00000000000034f7e6059bbc78f2
Content-Type: text/plain; charset="UTF-8"

It does exist, because older PGP were mandated (by RFC 4880) to use SHA1.
Other implementations can coexist with different digest functions, though,
so read on...

We've known for a while that reliance on SHA1 was problematic - see the top
of src/crypto/external/bsd/netpgp/dist/src/netpgp/netpgp.c where the
default for new netpgp-signatures is sha256:

/*
 * SHA1 is now looking as though it should not be used.  Let's
 * pre-empt this by specifying SHA256 - gpg interoperates just fine
 * with SHA256 - agc, 20090522
 */
#define DEFAULT_HASH_ALG "SHA256"

I'm aware of the dangers of downgrading various things, though not PGP?
Quite happy to panic if warranted



On Wed, 8 Jan 2020 at 08:16, <[email protected]> wrote:

> hi folks,
>
> this: https://sha-mbles.github.io/
> suggests it might be wise to rip out SHA1 support in netpgp, which seems
> to exist.
>
>

--00000000000034f7e6059bbc78f2
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr">It does exist, because older PGP were mandated (by RFC 488=
0) to use SHA1. Other implementations can coexist with different digest fun=
ctions, though, so read on...<div><br></div><div>We&#39;ve known for a whil=
e that reliance on SHA1 was problematic - see the top of src/crypto/externa=
l/bsd/netpgp/dist/src/netpgp/netpgp.c where the default for new netpgp-sign=
atures is sha256:<br></div><div><br></div><div>/*<br>=C2=A0* SHA1 is now lo=
oking as though it should not be used.=C2=A0 Let&#39;s<br>=C2=A0* pre-empt =
this by specifying SHA256 - gpg interoperates just fine<br>=C2=A0* with SHA=
256 - agc, 20090522<br>=C2=A0*/<br>#define DEFAULT_HASH_ALG &quot;SHA256&qu=
ot;<br></div><div><br></div><div>I&#39;m aware of the dangers of downgradin=
g various things, though not PGP? Quite happy to panic if warranted<br><div=
><br></div><div><br></div></div></div><br><div class=3D"gmail_quote"><div d=
ir=3D"ltr" class=3D"gmail_attr">On Wed, 8 Jan 2020 at 08:16, &lt;<a href=3D=
"mailto:[email protected]">[email protected]</a>&gt; wrote:<br></div><blockquote cl=
ass=3D"gmail_quote" style=3D"margin:0px 0px 0px 0.8ex;border-left:1px solid=
 rgb(204,204,204);padding-left:1ex">hi folks,<br>
<br>
this: <a href=3D"https://sha-mbles.github.io/" rel=3D"noreferrer" target=3D=
"_blank">https://sha-mbles.github.io/</a><br>
suggests it might be wise to rip out SHA1 support in netpgp, which seems<br=
>
to exist.<br>
<br>
</blockquote></div>

--00000000000034f7e6059bbc78f2--