3 replaced http://security.stackexchange.com/ with https://security.stackexchange.com/
source | link

GnuPG is an implementation of OpenPGP. You can use GnuPG(GPG) to encrypt and sign your data and messages. You can also use GPG to compute the hash of some data. When you do this you can choose what hashing algorithm you use. It looks like GPG supports a variety of algorithms including the "newer" SHA-2 functions.

You can use various ciphers to encrypt your data with GPG. When you encrypt you choose a passphrase. From this passphrase a key is generated. So if you use AES 256 the key will be 256 bits. The way that the key is generated from the passphrase is using the key scheduling. Some algorithms might use SHA1, but I don't believe that GnuPG does.

The one place where the hashing algorithm does come in is when signing. According to this random blog post (from 2013) GPG by default uses SHA1. But you can change this as alluded to in the other answer (and as described in the random blog post).

So in the end, you shouldn't have to worry because SHA1 doesn't have anything to do with the key.

Also, from what I understand SHA1 is still in general considered safe. I am guessing that many people are trying to get away from it because it has been around for a while. Even though he is a controversial figure, "Security expert" Steve Gibson discussed SHA1 on a recent episode of Security Now. This might be interesting (even though he might not actually be a "security expert"). (Please don't downvote just because you don't like Steve Gibson.) One point he makes is that when MD5 was found to be insecure, people were caught a bit by surprise. So to avoid this, some would suggest not to use SHA1 simply because it is too old and it is likely that it will crumble soon (if it hasn't already). And that is supposedly why Google will stop using SHA1 (see also here).

Some other interesting reading might be

GnuPG is an implementation of OpenPGP. You can use GnuPG(GPG) to encrypt and sign your data and messages. You can also use GPG to compute the hash of some data. When you do this you can choose what hashing algorithm you use. It looks like GPG supports a variety of algorithms including the "newer" SHA-2 functions.

You can use various ciphers to encrypt your data with GPG. When you encrypt you choose a passphrase. From this passphrase a key is generated. So if you use AES 256 the key will be 256 bits. The way that the key is generated from the passphrase is using the key scheduling. Some algorithms might use SHA1, but I don't believe that GnuPG does.

The one place where the hashing algorithm does come in is when signing. According to this random blog post (from 2013) GPG by default uses SHA1. But you can change this as alluded to in the other answer (and as described in the random blog post).

So in the end, you shouldn't have to worry because SHA1 doesn't have anything to do with the key.

Also, from what I understand SHA1 is still in general considered safe. I am guessing that many people are trying to get away from it because it has been around for a while. Even though he is a controversial figure, "Security expert" Steve Gibson discussed SHA1 on a recent episode of Security Now. This might be interesting (even though he might not actually be a "security expert"). (Please don't downvote just because you don't like Steve Gibson.) One point he makes is that when MD5 was found to be insecure, people were caught a bit by surprise. So to avoid this, some would suggest not to use SHA1 simply because it is too old and it is likely that it will crumble soon (if it hasn't already). And that is supposedly why Google will stop using SHA1 (see also here).

Some other interesting reading might be

GnuPG is an implementation of OpenPGP. You can use GnuPG(GPG) to encrypt and sign your data and messages. You can also use GPG to compute the hash of some data. When you do this you can choose what hashing algorithm you use. It looks like GPG supports a variety of algorithms including the "newer" SHA-2 functions.

You can use various ciphers to encrypt your data with GPG. When you encrypt you choose a passphrase. From this passphrase a key is generated. So if you use AES 256 the key will be 256 bits. The way that the key is generated from the passphrase is using the key scheduling. Some algorithms might use SHA1, but I don't believe that GnuPG does.

The one place where the hashing algorithm does come in is when signing. According to this random blog post (from 2013) GPG by default uses SHA1. But you can change this as alluded to in the other answer (and as described in the random blog post).

So in the end, you shouldn't have to worry because SHA1 doesn't have anything to do with the key.

Also, from what I understand SHA1 is still in general considered safe. I am guessing that many people are trying to get away from it because it has been around for a while. Even though he is a controversial figure, "Security expert" Steve Gibson discussed SHA1 on a recent episode of Security Now. This might be interesting (even though he might not actually be a "security expert"). (Please don't downvote just because you don't like Steve Gibson.) One point he makes is that when MD5 was found to be insecure, people were caught a bit by surprise. So to avoid this, some would suggest not to use SHA1 simply because it is too old and it is likely that it will crumble soon (if it hasn't already). And that is supposedly why Google will stop using SHA1 (see also here).

Some other interesting reading might be

2 added 174 characters in body
source | link

GnuPG is an implementation of OpenPGP. You can use GnuPG(GPG) to encrypt and sign your data and messages. You can also use GPG to compute the hash of some data. When you do this you can choose what hashing algorithm you use. It looks like GPG supports a variety of algorithms including the "newer" SHA-2 functions.

You can use various ciphers to encrypt your data with GPG. When you encrypt you choose a passphrase. From this passphrase a key is generated. So if you use AES 256 the key will be 256 bits. The way that the key is generated from the passphrase is using the key scheduling. Some algorithms might use SHA1, but I don't believe that GnuPG does.

The one place where the hashing algorithm does come in is when signing. According to this random blog post (from 2013) GPG by default uses SHA1. But you can change this as alluded to in the other answer (and as described in the random blog post).

So in the end, you shouldn't have to worry because SHA1 doesn't have anything to do with the key.

Also, from what I understand SHA1 is still in general considered safe. I am guessing that many people are trying to get away from it because it has been around for a while. Even though he is a controversial figure, "Security expert" Steve Gibson discussed SHA1 on a recent episode of Security Now. This might be interesting (even though he might not actually be a "security expert"). (Please don't downvote just because you don't like Steve Gibson.) One point he makes is that when MD5 was found to be insecure, people were caught a bit by surprise. So to avoid this, some would suggest not to use SHA1 simply because it is too old and it is likely that it will crumble soon (if it hasn't already). And that is supposedly why Google will stop using SHA1 (see also here).

Some other interesting reading might be

GnuPG is an implementation of OpenPGP. You can use GnuPG(GPG) to encrypt and sign your data and messages. You can also use GPG to compute the hash of some data. When you do this you can choose what hashing algorithm you use. It looks like GPG supports a variety of algorithms including the "newer" SHA-2 functions.

You can use various ciphers to encrypt your data with GPG. When you encrypt you choose a passphrase. From this passphrase a key is generated. So if you use AES 256 the key will be 256 bits. The way that the key is generated from the passphrase is using the key scheduling. Some algorithms might use SHA1, but I don't believe that GnuPG does.

The one place where the hashing algorithm does come in is when signing. According to this random blog post (from 2013) GPG by default uses SHA1. But you can change this as alluded to in the other answer (and as described in the random blog post).

So in the end, you shouldn't have to worry because SHA1 doesn't have anything to do with the key.

Also, from what I understand SHA1 is still in general considered safe. I am guessing that many people are trying to get away from it because it has been around for a while. Even though he is a controversial figure, "Security expert" Steve Gibson discussed SHA1 on a recent episode of Security Now. This might be interesting (even though he might not actually be a "security expert"). (Please don't downvote just because you don't like Steve Gibson.) One point he makes is that when MD5 was found to be insecure, people were caught a bit by surprise. So to avoid this, some would suggest not to use SHA1 simply because it is too old and it is likely that it will crumble soon (if it hasn't already).

Some other interesting reading might be

GnuPG is an implementation of OpenPGP. You can use GnuPG(GPG) to encrypt and sign your data and messages. You can also use GPG to compute the hash of some data. When you do this you can choose what hashing algorithm you use. It looks like GPG supports a variety of algorithms including the "newer" SHA-2 functions.

You can use various ciphers to encrypt your data with GPG. When you encrypt you choose a passphrase. From this passphrase a key is generated. So if you use AES 256 the key will be 256 bits. The way that the key is generated from the passphrase is using the key scheduling. Some algorithms might use SHA1, but I don't believe that GnuPG does.

The one place where the hashing algorithm does come in is when signing. According to this random blog post (from 2013) GPG by default uses SHA1. But you can change this as alluded to in the other answer (and as described in the random blog post).

So in the end, you shouldn't have to worry because SHA1 doesn't have anything to do with the key.

Also, from what I understand SHA1 is still in general considered safe. I am guessing that many people are trying to get away from it because it has been around for a while. Even though he is a controversial figure, "Security expert" Steve Gibson discussed SHA1 on a recent episode of Security Now. This might be interesting (even though he might not actually be a "security expert"). (Please don't downvote just because you don't like Steve Gibson.) One point he makes is that when MD5 was found to be insecure, people were caught a bit by surprise. So to avoid this, some would suggest not to use SHA1 simply because it is too old and it is likely that it will crumble soon (if it hasn't already). And that is supposedly why Google will stop using SHA1 (see also here).

Some other interesting reading might be

1
source | link

GnuPG is an implementation of OpenPGP. You can use GnuPG(GPG) to encrypt and sign your data and messages. You can also use GPG to compute the hash of some data. When you do this you can choose what hashing algorithm you use. It looks like GPG supports a variety of algorithms including the "newer" SHA-2 functions.

You can use various ciphers to encrypt your data with GPG. When you encrypt you choose a passphrase. From this passphrase a key is generated. So if you use AES 256 the key will be 256 bits. The way that the key is generated from the passphrase is using the key scheduling. Some algorithms might use SHA1, but I don't believe that GnuPG does.

The one place where the hashing algorithm does come in is when signing. According to this random blog post (from 2013) GPG by default uses SHA1. But you can change this as alluded to in the other answer (and as described in the random blog post).

So in the end, you shouldn't have to worry because SHA1 doesn't have anything to do with the key.

Also, from what I understand SHA1 is still in general considered safe. I am guessing that many people are trying to get away from it because it has been around for a while. Even though he is a controversial figure, "Security expert" Steve Gibson discussed SHA1 on a recent episode of Security Now. This might be interesting (even though he might not actually be a "security expert"). (Please don't downvote just because you don't like Steve Gibson.) One point he makes is that when MD5 was found to be insecure, people were caught a bit by surprise. So to avoid this, some would suggest not to use SHA1 simply because it is too old and it is likely that it will crumble soon (if it hasn't already).

Some other interesting reading might be