Sign master key user IDs with a stronger hash algorithm than SHA-1

Task Info (Flyspray)
Opened By	Jonas Witschel (diabonas)
Task ID	68501
Type	Bug Report
Project	Keyring
Category	Signatures
Version	None
OS	None
Opened	2020-11-02 11:02:13 UTC
Status	Assigned

Details

Two of the current master keys, namely AB19265E5D7D20687D303246BA1DFB64FFF979E7 (Allan McRae) and 0E8B644079F599DFC1DDC3973348882F6AC6A4C2 (Pierre Schmitz) use SHA-1 for the self-signature of the user ID. [1] Since this hash algorithm has been broken [2], the self-signature should be renewed using a stronger hash algorithm like SHA-512. This can be done using the following GnuPG command [3]:

gpg --expert --cert-digest-algo SHA512 --sign-key

The success of this operation can be checked e.g. using hopenpgp-tools from [community] by running the following command [4]:

hkt --export-pubkeys | hokey lint

The output of this commands should not have any red marks, both "Self-sig hash algorithms" and all "binding sig hash algorithms" and "cross-cert hash algorithms" should read "[SHA-512]".

[1] https://gitlab.com/sequoia-pgp/sequoia/-/issues/595#note_434331334 [2] https://shattered.io/ [3] Suggested to me by Wiktor Kwapisiewicz in private communication. [4] https://riseup.net/en/security/message-security/openpgp/best-practices#openpgp-key-checks