3

I have specified personal digest preferences in my ~/.gnupg/gpg.conf:

personal-digest-preferences SHA512 SHA256 SHA384 SHA224 SHA1

then, I have generated a new key pair. But when I check the preferred algorithms, I see they are at their defaults, instead of my specified preferences:

gpg -a --export "[email protected]" | gpg --list-packets | grep 'pref-hash-*'
hashed subpkt 21 len 5 (pref-hash-algos: 8 2 9 10 11)

8 2 9 10 11 corresponds to SHA256 SHA-1 SHA384 SHA512 SHA224

Why are my preferences being ignored?

How can I enforce them when generating a new key pair?

1 Answer 1

1

The personal-digest-preferences option does not set preferred digest algorithms for creating keys, but during signing (if also encrypting at the same time, the most preferred algorithm supported by the recipient is chosen). From man gpg:

   --personal-digest-preferences string
          Set  the list of personal digest preferences to string.  Use gpg --version to
          get a list of available algorithms, and use none to set no preference at all.
          This allows the user to safely override the algorithm chosen by the recipient
          key preferences, as GPG will only select an algorithm that is usable  by  all
          recipients.   The  most  highly  ranked digest algorithm in this list is also
          used when signing without encryption (e.g. --clearsign or --sign).

To set the default preferences for creating new keys, use default-preference list instead. Be aware this requires the same input you'd use for setpref in the --edit-key menu; containing all your preferences for encryption, digest and compression algorithms.

   --edit-key
          Present  a  menu  which  enables you to do most of the key management related
          tasks.  It expects the specification of a key on the command line.

          [...]

          setpref string
                 Set  the  list  of  user ID preferences to string for all (or just the
                 selected) user IDs. Calling setpref with no arguments sets the prefer‐
                 ence list to the default (either built-in or set via --default-prefer‐
                 ence-list), and calling setpref with "none" as the  argument  sets  an
                 empty  preference  list. [...]

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .