[Author Prev][Author Next][Thread Prev][Thread Next][Author Index][Thread Index]
Re: [tor-bugs] #9930 [Website]: SHA-1 is weak: Use better hash to generate signatures
#9930: SHA-1 is weak: Use better hash to generate signatures
-------------------------+-----------------
Reporter: mkral | Owner:
Type: defect | Status: new
Priority: normal | Milestone:
Component: Website | Version:
Resolution: | Keywords:
Actual Points: | Parent ID:
Points: |
-------------------------+-----------------
Comment (by mkral):
Replying to [comment:1 nickm]:
> If the signatures on the website start using a better hash, which
versions of gnupg will be able to check them? I support this, so long as
we're not going to start depending on a very rare gnupg version.
According to Gnupg changelog, read-only support for SHA-256 hash, SHA-384
and SHA-512 hashes was added in in version 1.3.2 (2003-05-27). Full
(read/write) support for the SHA-256 hash has been added in version 1.3.3
(2003-10-10)
In version Gnupg 1.4.10 (2009-09-02). The default hash algorithm
preferences has changed to prefer SHA-256 over SHA-1.
--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/9930#comment:2>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online
_______________________________________________
tor-bugs mailing list
tor-bugs@xxxxxxxxxxxxxxxxxxxx
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs