GNU bug report logs - #37420
[PATCH] Recommend against SHA-1 for security-related applications

Previous Next

Full log

Message #32 received at 37420 <at> debbugs.gnu.org (full text, mbox):

From: Stefan Kangas <stefan <at> marxist.se>
To: Lars Ingebrigtsen <larsi <at> gnus.org>
Cc: 37420 <at> debbugs.gnu.org
Subject: Re: bug#37420: [PATCH] Recommend against SHA-1 for security-related
 applications
Date: Tue, 17 Sep 2019 11:17:44 +0200

Lars Ingebrigtsen <larsi <at> gnus.org> writes:

> > +These symbols corresponds to the following hashing algorithms:
> > +
> > +    md5    - MD5
> > +    sha1   - SHA-1
> > +    sha224 - SHA-2 / SHA-224
> > +    sha256 - SHA-2 / SHA-384
> > +    sha384 - SHA-2 / SHA-384
> > +    sha512 - SHA-2 / SHA-512
>
> I'm not sure these really clarify all that much?  But I don't object to
> it.

They would help people like me who don't use this stuff very often and
can't remember which one is SHA-1, SHA-2, SHA-3, etc.  Of course, one
could expect users to fire up a web browser and search the web for
details instead.  But as it stands, we don't document anywhere that
sha512 is indeed SHA-2 as far as I can tell.

> > --- a/test/lisp/emacs-lisp/package-resources/archive-contents
[...]
> Hm...  is this related?

No, please disregard that.  I fixed it but then attached the wrong
patch to the email.

Best regards,
Stefan Kangas

Previous Next

GNU bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson.