This page says:

self-signatures must not use SHA1

You can check this by doing:

gpg --export-options export-minimal --export <keyid> | gpg --list-packets |grep -A 2 signature|grep 'digest algo 2,'

If you see any ‘digest algo 2’ results printed, then you have some self-signatures that are using SHA1, as digest algo 2 is SHA1. See the OpenPGP RFC 4880, section 9.4 for a table that maps hash algorithms to numbers.

I set up a key following best practice instructions (Debian's developer keysigning guidelines), but I get digest algo 2 lines printed when I run this. What exactly does this mean, and what part of setting up the key affects this?


This does mean some part is signed using SHA1 as hashing algorithm. If you view the full output of gpg --export-options export-minimal --export <keyid> | gpg --list-packets, you may find which part.

| improve this answer | |
  • I thought I'd followed all the "best practice instructions" for a secure key, but I apparently hadn't. Following the steps here to generate a new key resulted in one that passed all the tests from the site in my original question. – jrdioko Aug 3 '11 at 22:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.