#6055 Add ALLOW_INSECURE_SHA1_HASH flag support#6065
Conversation
…-for-allowing-insecure-sha1-hash
|
Currently trying to write a test for this change. |
| if (this.clientConfiguration.shouldAllowInsecureSha1Hash() && typeof opgp !== 'undefined') { | ||
| opgp.config.rejectHashAlgorithms = new Set([...defaultRejectedHashAlgo]); | ||
| } else { | ||
| opgp.config.rejectHashAlgorithms = new Set([...defaultRejectedHashAlgo, opgp.enums.hash.sha1]); | ||
| } |
There was a problem hiding this comment.
Hi @martgil, I think we shouldn't completely disable SHA1 algorithm with rejectHashAlgorithms property, as we already show error error verifying signature: Insecure hash algorithm: SHA1. Sender is using old, insecure OpenPGP software. when user verifies message signed with sha1 key.
Disabling sha1 entirely would also make it impossible for users to decrypt older messages encrypted with sha1 keys.
So let's just remove opgp.config.rejectHashAlgorithms property altogether.
There was a problem hiding this comment.
I understand completely, Roma, sorry. I'll be closing this PR and proceed with removing the rejectHashAlgorithms property in openpgp configuration.
2 participants
This PR adds a new client configuration flag called
ALLOW_INSECURE_SHA1_HASHin goal of supporting keys generated from a legacy system.close #6055
Tests (delete all except exactly one):
To be filled by reviewers
I have reviewed that this PR... (tick whichever items you personally focused on during this review):