Re: [Trustedqsl-testing] SHA encryption used?

[Rick M. <k1...@ar...>]

TQSL doesn't use SHA-1 (other than potential access to TLS-protected
webpages.)
TQSL uses MD5 for signing logs and for callsign certificates. Fedora
disabled MD5 some time ago, but enabled a bypass - MD5 is enabled if
environment variable OPENSSL_ENABLE_MD5_VERIFY is defined.
I'm assuming they'll do the same here for SHA-1.

So, in short, no impact. Perhaps Logbook needs to upgrade - RSA 1024 / MD5
could upgrade to at least 2048 and SHA-256. And signing update to use
SHA-256.  Doing that would require changes to both software at Logbook plus
TQSL changes to allow two different signing algorithms. Ultimately, it's a
question of when we'll be forced to upgrade.
73,
    -Rick

On Wed, Mar 9, 2022 at 12:34 PM Greg Troxel <gd...@le...> wrote:

>
> Richard Shaw <hob...@gm...> writes:
>
> > On Wed, Mar 9, 2022 at 8:01 AM Greg Troxel <gd...@le...> wrote:
> >
> >>
> >> Richard Shaw <hob...@gm...> writes:
> >>
> >> > Just a heads up, but Fedora Linux is considering dropping SHA-1
> support
> >> > since it's no longer considered secure. I can't remember what TQSL
> uses
> >> so
> >> > wanted to check her if TQSL would be impacted.
> >>
> >> Do you mean "remove support for SHA-1 from the system"?  That seems
> >> extreme and likely to cause a huge amount of trouble.   What's the story
> >> about git?
> >>
> >> If you mean "encorage use of SHA2 and others instead for most uses, and
> >> require it for validating packages", that's something else.
> >
> > Here's the link to the thread. It's probably better to read it there than
> > for me to try and paraphrase. I'm certainly not an encryption expert by
> any
> > means.
> >
> >
> https://lists.fedoraproject.org/archives/list/de...@li.../thread/VVLHQAWI3IQ7NRLKMUHJ27JV3V2JAFDP/
>
> Thanks.  It looks like it means withdraw SHA-1 from openssl.  Wow.
>
> Here's the key quote:
>
>   Fedora is a large distribution with short release cycles, and the only
>   realistic way to weed out its reliance on SHA-1 signatures from all of
>   its numerous dark corners is to break them.
>
> _______________________________________________
> Trustedqsl-testing mailing list
> Tru...@li...
> https://lists.sourceforge.net/lists/listinfo/trustedqsl-testing
>


-- 
Rick Murphy, D.Sc., CISSP-ISSAP, K1MU/4, Annandale VA USA