diff options
| author | Daniel Kahn Gillmor <[email protected]> | 2017-09-07 22:49:35 +0000 |
|---|---|---|
| committer | Daniel Kahn Gillmor <[email protected]> | 2019-07-20 18:16:20 +0000 |
| commit | a446c4db957492b759c1b8e9ffa384efa3fdf7ee (patch) | |
| tree | 604ed2d6fe147e9a7bc634b0936fe1f3b46e9405 | |
| parent | gpg: default to AES-256. (diff) | |
| download | gnupg-a446c4db957492b759c1b8e9ffa384efa3fdf7ee.tar.gz gnupg-a446c4db957492b759c1b8e9ffa384efa3fdf7ee.zip | |
gpg: Default to SHA-512 for all signature types on RSA keys.
* g10/main.h (DEFAULT_DIGEST_ALGO): Use SHA512 instead of SHA256 in
--gnupg mode (leave strict RFC and PGP modes alone).
* configure.ac: Do not allow disabling sha512.
* g10/misc.c (map_md_openpgp_to_gcry): Always support SHA512.
--
SHA512 is more performant on most 64-bit platforms than SHA256, and
offers a better security margin. It is also widely implemented.
Signed-off-by: Daniel Kahn Gillmor <[email protected]>
Gbp-Pq: Topic update-defaults
Gbp-Pq: Name gpg-Default-to-SHA-512-for-all-signature-types-on-RS.patch
Diffstat (limited to '')
| -rw-r--r-- | configure.ac | 2 | ||||
| -rw-r--r-- | g10/main.h | 2 | ||||
| -rw-r--r-- | g10/misc.c | 5 |
3 files changed, 3 insertions, 6 deletions
diff --git a/configure.ac b/configure.ac index 19cf8e86c..6fd90d1b6 100644 --- a/configure.ac +++ b/configure.ac @@ -317,7 +317,7 @@ GNUPG_GPG_DISABLE_ALGO([rmd160],[RIPE-MD160 hash]) GNUPG_GPG_DISABLE_ALGO([sha224],[SHA-224 hash]) # SHA256 is a MUST algorithm for GnuPG. GNUPG_GPG_DISABLE_ALGO([sha384],[SHA-384 hash]) -GNUPG_GPG_DISABLE_ALGO([sha512],[SHA-512 hash]) +# SHA512 is a MUST algorithm for GnuPG. # Allow disabling of zip support. diff --git a/g10/main.h b/g10/main.h index 578a9cb9e..e0fd51856 100644 --- a/g10/main.h +++ b/g10/main.h @@ -41,7 +41,7 @@ # define DEFAULT_CIPHER_ALGO CIPHER_ALGO_3DES #endif -#define DEFAULT_DIGEST_ALGO ((GNUPG)? DIGEST_ALGO_SHA256:DIGEST_ALGO_SHA1) +#define DEFAULT_DIGEST_ALGO ((GNUPG)? DIGEST_ALGO_SHA512:DIGEST_ALGO_SHA1) #define DEFAULT_S2K_DIGEST_ALGO DIGEST_ALGO_SHA1 #ifdef HAVE_ZIP # define DEFAULT_COMPRESS_ALGO COMPRESS_ALGO_ZIP diff --git a/g10/misc.c b/g10/misc.c index 6d525a817..814447132 100644 --- a/g10/misc.c +++ b/g10/misc.c @@ -751,11 +751,8 @@ map_md_openpgp_to_gcry (digest_algo_t algo) case DIGEST_ALGO_SHA384: return 0; #endif -#ifdef GPG_USE_SHA512 case DIGEST_ALGO_SHA512: return GCRY_MD_SHA512; -#else - case DIGEST_ALGO_SHA512: return 0; -#endif + default: return 0; } } |