|
|
Log in / Subscribe / Register

Removing SHA-1 for signatures in Fedora

Removing SHA-1 for signatures in Fedora

Posted Mar 21, 2022 4:56 UTC (Mon) by mathstuf (subscriber, #69389)
In reply to: Removing SHA-1 for signatures in Fedora by hkario
Parent article: Removing SHA-1 for signatures in Fedora

> Or to put it other way, just like certificates have expiry dates on them, so do hashes.

It seems like the API for verifying signatures needs to be richer then. Allow verifying anything, but have it decorated with an "expiry date" kind of tag so that you can get tags like:

> Verified (trusted)
> Verified (be suspicious if signed after 2022-01)

Basically, it sounds like a simple boolean is just not rich enough to convey signature validity.

to post comments

Removing SHA-1 for signatures in Fedora

Posted Mar 21, 2022 19:03 UTC (Mon) by hkario (subscriber, #94864) [Link]

There has been interfaces to perform certificate verification at a given time for decades now.
The thing is that basically no signature includes a trustworthy timestamp that allows you to perform verification at any other time than *now*.

Those interfaces are used for systems that handle CAdES or PAdES, not S/MIME, SSH and TLS.


Copyright © 2026, Eklektix, Inc.
Comments and public postings are copyrighted by their creators.
Linux is a registered trademark of Linus Torvalds