sergio/takana
> Una distribución Linux construida con un laboratorio funcional y hermético en el > sótano, y una terminal mutable, clásica y anárquica en el piso de arriba — diseñada > desde el suelo para que una IA programadora entienda, modifique y co…
⎇ f06d943f9365bd17dd8db1b79f17862e559a8ff8
recipes/0330-gpg-default-to-sha512-for-all-signature-types-on-rsa-keys.patch
History
raw
base-system-3: promover cadena crypto + libusb/usbutils + gnupg (índice 743)
1From: Daniel Kahn Gillmor <dkg@fifthhorseman.net>
2Date: Thu, 7 Sep 2017 18:49:35 -0400
3Subject: gpg: Default to SHA-512 for all signature types on RSA keys.
4
5* g10/main.h (DEFAULT_DIGEST_ALGO): Use SHA512 instead of SHA256 in
6--gnupg mode (leave strict RFC and PGP modes alone).
7* configure.ac: Do not allow disabling sha512.
8* g10/misc.c (map_md_openpgp_to_gcry): Always support SHA512.
9
10--
11
12SHA512 is more performant on most 64-bit platforms than SHA256, and
13offers a better security margin. It is also widely implemented.
14
15Signed-off-by: Daniel Kahn Gillmor <dkg@fifthhorseman.net>
16---
17 configure.ac | 2 +-
18 g10/main.h | 2 +-
19 g10/misc.c | 5 +----
20 3 files changed, 3 insertions(+), 6 deletions(-)
21
22Patch-Source: https://sources.debian.org/data/main/g/gnupg2/2.2.27-2/debian/patches/update-defaults/gpg-Default-to-SHA-512-for-all-signature-types-on-RS.patch
23
24diff --git a/configure.ac b/configure.ac
25index c31ae02..f7788b3 100644
26--- a/configure.ac
27+++ b/configure.ac
28@@ -339,7 +339,7 @@ GNUPG_GPG_DISABLE_ALGO([rmd160],[RIPE-MD160 hash])
29 GNUPG_GPG_DISABLE_ALGO([sha224],[SHA-224 hash])
30 # SHA256 is a MUST algorithm for GnuPG.
31 GNUPG_GPG_DISABLE_ALGO([sha384],[SHA-384 hash])
32-GNUPG_GPG_DISABLE_ALGO([sha512],[SHA-512 hash])
33+# SHA512 is a MUST algorithm for GnuPG.
34
35
36 # Allow disabling of zip support.
37diff --git a/g10/main.h b/g10/main.h
38index b29e23e..0a64a21 100644
39--- a/g10/main.h
40+++ b/g10/main.h
41@@ -41,7 +41,7 @@
42 # define DEFAULT_CIPHER_ALGO CIPHER_ALGO_3DES
43 #endif
44
45-#define DEFAULT_DIGEST_ALGO ((GNUPG)? DIGEST_ALGO_SHA256:DIGEST_ALGO_SHA1)
46+#define DEFAULT_DIGEST_ALGO ((GNUPG)? DIGEST_ALGO_SHA512:DIGEST_ALGO_SHA1)
47 #define DEFAULT_S2K_DIGEST_ALGO DEFAULT_DIGEST_ALGO
48 #ifdef HAVE_ZIP
49 # define DEFAULT_COMPRESS_ALGO COMPRESS_ALGO_ZIP
50diff --git a/g10/misc.c b/g10/misc.c
51index 2f4b452..0e6d9d5 100644
52--- a/g10/misc.c
53+++ b/g10/misc.c
54@@ -862,11 +862,8 @@ map_md_openpgp_to_gcry (digest_algo_t algo)
55 case DIGEST_ALGO_SHA384: return 0;
56 #endif
57
58-#ifdef GPG_USE_SHA512
59 case DIGEST_ALGO_SHA512: return GCRY_MD_SHA512;
60-#else
61- case DIGEST_ALGO_SHA512: return 0;
62-#endif
63+
64 default: return 0;
65 }
66 }