This page says:

self-signatures must not use SHA1

You can check this by doing:

gpg --export-options export-minimal --export <keyid> | gpg --list-packets |grep -A 2 signature|grep 'digest algo 2,'

If you see any ‘digest algo 2’ results printed, then you have some self-signatures that are using SHA1, as digest algo 2 is SHA1. See the OpenPGP RFC 4880, section 9.4 for a table that maps hash algorithms to numbers.

I set up a key following best practice instructions (Debian's developer keysigning guidelines), but I get digest algo 2 lines printed when I run this. What exactly does this mean, and what part of setting up the key affects this?

1 Answer 1


This does mean some part is signed using SHA1 as hashing algorithm. If you view the full output of gpg --export-options export-minimal --export <keyid> | gpg --list-packets, you may find which part.

  • I thought I'd followed all the "best practice instructions" for a secure key, but I apparently hadn't. Following the steps here to generate a new key resulted in one that passed all the tests from the site in my original question.
    – jrdioko
    Aug 3, 2011 at 22:54

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .