Tag Info

New answers tagged

1

Before I give my answer, lets first go over the subject of HMAC. Hash-based message authentication code (or HMAC) is a mechanism for calculating a message authentication code involving a hash function in combination with a secret key. This can be used to verify the integrity and authenticity of a a message. Now HMAC authentication guarantees the ...


-1

I'm fairly certain SHA-1 will be deprecated by most OS's by 2017. Especially with browsers taking the initiative and flagging certificates secured by SHA-1 by mid 2016 and Google's project Zero cracking the whip on implementing encryption over the web. The issue here isn't about connectivity. It's about pressuring network administrators/device ...


1

SHA-1 is only one of the many hashing algorithms available in the OpenPGP standard. You can (and should) choose better algorithms for signing documents or keys. However, SHA-1 is the only algorithm used for generating an OpenPGP V4 fingerprint. Is this an issue? I think not for the immediate future. There are two kinds of attacks on a hashing algorithm. ...


1

No. It's irrelevant, although it's better that they don't use weak root signatures. I think the setting may refer to the intermediate CA instead. Remember that from 01/01/2017 Microsoft will start rejecting SHA-1 signed SSL certificates, and Google will degrade the security level indicator for those sites with a certificate which is valid after 01/01/2016, ...


0

GnuPG is an implementation of OpenPGP. You can use GnuPG(GPG) to encrypt and sign your data and messages. You can also use GPG to compute the hash of some data. When you do this you can choose what hashing algorithm you use. It looks like GPG supports a variety of algorithms including the "newer" SHA-2 functions. You can use various ciphers to encrypt your ...


2

'gpg --version' will show your prefs. Add similar to gpg.conf (your prefs, of course): personal-cipher-preferences AES256 TWOFISH AES192 AES personal-digest-preferences SHA512 SHA384 SHA256 personal-compress-preferences ZLIB BZIP2 ZIP As for your key, I don't have that answer. But, as your daily key should be a SUB, revoke the SUB and re-issue a new ...


4

There is no contradiction. Linus himself sais in that same talk: If I have those 20 bytes, I can download a git repository from a completely untrusted source and I can guarantee that they did not do anything bad to it. I'd interpret the "Git uses SHA-1 not for security" as "SHA-1 hasn't been added to git for security reasons, but for reliability ...



Top 50 recent answers are included