News for hackers. Stuff that matters.

A comment on GnuPG 2.2.23. Parent comment

Re:GnuPG 2.2.23 by melvyn2 on Friday September 04, 2020 @01:00PM (#24376708)
I can't seem to use minisign with git, which is my main use for gpg.
[ Parent | on HN ]
Re:GnuPG 2.2.23 by dependenttypes on Friday September 04, 2020 @01:26PM (#24376988)
Signing git commits is broken anyway as you are basically signing the commit hash (which is a sha1, whose collision resistance is broken).
[ Parent | on HN ]
Re:GnuPG 2.2.23 by cordite on Friday September 04, 2020 @04:06PM (#24378419)
I recall hearing github is planning on Sha-256 some time
[ Parent | on HN ]
Re:GnuPG 2.2.23 by some_furry on Friday September 04, 2020 @04:17PM (#24378491)
They're more likely to employ counter-cryptanalysis [1] in the meantime.

[1] https://github.com/cr-marcstevens/sha1collisiondetection

[ Parent | on HN ]