0

I was curious about setting SHA-3 as the preferred hashing algorithm for GPG but that looks like it is not yet supported and the documentation states this:

SHA-3: SHA-3 is a completely new hash algorithm that makes a clean break with the previous SHAs. It is believed to be safe, with no warnings about its usage. It hasn’t yet been officially introduced into the OpenPGP standard, and for that reason GnuPG doesn’t support it. However, SHA-3 will probably be incorporated into the spec, and GnuPG will support it as soon as it does.

What does this mean: "...and GnuPG will support it as soon as it does"?

Are there any development plans for supporting SHA3 or BLAKE?

Improve this question
2
  • Is there a reason you think that SHA-2 is not secure enough? The reason why SHA-3 was created is fairly complex, and not related to concrete security issues in any previous hash. AFAIK, they wanted something with a fundamentally-different design (a sponge function made from a public permutation), and wanted something more flexible (in this case, an XOF). They also wanted it to work more efficiently in hardware (Keccak is very fast in silicon), and wished to protect from attacks that are irrelevant to PGP (such as length extension attacks).
    – forest
    Commented May 9, 2021 at 21:34
  • @forest, Just as you mentioned, this is purely subjective to user preference and not about security/weakness of one over another. As you said too, this is more of the speed and having cutting edge innovation. But over time it would be great to have support of SHA-3 or similar.
    – J. Doe
    Commented May 9, 2021 at 22:34

2 Answers 2

Reset to default
4

Are there any development plans for supporting SHA3 or BLAKE?

These algorithms are already included in the Libgcrypt library. It is only a matter of getting them incorporated into the OpenPGP standard for GnuPG to make use of them.

The GnuPG developers are working towards getting the OpenPGP Message Format updated from RFC 4880. The current work-in-progress for the new standard can be seen here. SHA3-256 and SHA3-512 are included in the draft, but not BLAKE.

Improve this answer
1
  • I looked at the RFC, there is quite a lot that will be introduced. Thanks for sharing that.
    – J. Doe
    Commented May 10, 2021 at 1:00
0

It hasn’t yet been officially introduced into the OpenPGP standard, and for that reason GnuPG doesn’t support it

I think this is pretty clear: GnuPG implement OpenPGP. SHA-3 is not in the OpenPGP standard.

...and GnuPG will support it as soon as it does

This just means: As soon as it is in the OpenPGP standard, GnuPG will implement it too.

Improve this answer
2
  • does that mean if, "assuming sha-3 is support", one set it up as their preferred algorithm, and there recipient has not, that would fail? Let take a look at this: personal-digest-preferences SHA512. does that mean if I a recipient does not have sha-512 it will fail?
    – J. Doe
    Commented May 9, 2021 at 21:16
  • @sec-social: I've removed this part from the answer. Looks like gnupg will use the digest preferences only if the algorithms are also in the preferences for the recipients key.
    – Steffen Ullrich
    Commented May 9, 2021 at 22:03

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .