Content-Transfer-Encoding: quoted-printable
Content-Type: text/plain;
	charset=utf-8
From: Ferris Ellis <ferris@ferrisellis.com>
Precedence: list
Mime-Version: 1.0 (1.0)
Subject: [alpine-devel] Upgrading package signatures from SHA1 to SHA2 digest. 
Message-Id: <257B6969-21FD-4D51-A8EC-95CB95CEF365@ferrisellis.com>
Date: Wed, 7 Mar 2018 18:28:49 -0500
To: alpine-devel@lists.alpinelinux.org

Dear alpine-devel mailing list,

I was looking into using a crypto-service to do Apline package build signatu=
res (as opposed to using a key on disk) and in doing so stumbled across the f=
act that Alpine package signatures currently use SHA1 digests. After a quick=
 search on https://lists.alpinelinux.org I didn=E2=80=99t see any prior disc=
ussions related to this fact and thus am posting this to the mailing list.

I wanted to start a dialog about the possibility of moving to using SHA2 dig=
ests (I would presume SHA256 would be the preferred option) for signatures a=
s SHA1 is deemed insecure by many and is being phased out for most usage of P=
KI. This includes my use case, where the crypto-service I have deliberately n=
o longer offers signatures with SHA1 digests and instead offers standard SHA=
2 digests.

If the community is interested I=E2=80=99m happy to submit a more formal RFC=
 on this. But, as I=E2=80=99m relatively new to the mailing list, I figured i=
t was best to start with just a dialog!

Cheers,
Ferris



---
Unsubscribe:  alpine-devel+unsubscribe@lists.alpinelinux.org
Help:         alpine-devel+help@lists.alpinelinux.org
---