Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

This page says:

self-signatures must not use SHA1

You can check this by doing:

gpg --export-options export-minimal --export <keyid> | gpg --list-packets |grep -A 2 signature|grep 'digest algo 2,'

If you see any ‘digest algo 2’ results printed, then you have some self-signatures that are using SHA1, as digest algo 2 is SHA1. See the OpenPGP RFC 4880, section 9.4 for a table that maps hash algorithms to numbers.

I set up a key following best practice instructions (Debian's developer keysigning guidelines), but I get digest algo 2 lines printed when I run this. What exactly does this mean, and what part of setting up the key affects this?

share|improve this question
up vote 6 down vote accepted

This does mean some part is signed using SHA1 as hashing algorithm. If you view the full output of gpg --export-options export-minimal --export <keyid> | gpg --list-packets, you may find which part.

share|improve this answer
I thought I'd followed all the "best practice instructions" for a secure key, but I apparently hadn't. Following the steps here to generate a new key resulted in one that passed all the tests from the site in my original question. – jrdioko Aug 3 '11 at 22:54

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.