[Enigmail] Re: SHA-1 Broken

[John Clizbe]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Evandro Clivatti Dall'Agnol wrote:
> Shatadal wrote:
> | http://www.schneier.com/blog/archives/2005/02/sha1_broken.html
> |
> | Are the Enigmail developers thinking about adding SHA256, 384 and 512 to
> | Enigmail?
> 
> This is a good idea, and I don't think it's difficult, but I'm not a
> developer.

It has been said here before, support for SHA-256, SHA-384, SHA-512 will
be added WHEN the STANDARDS and RFCs include them.

At the present time, the Digital Signature Standard (DSS) only supports
1024 bit keys, and 160 bit hashes. This limits DSS signatures to using
MD5, SHA-1, or RIPEM160. This is the case for about 85% of all keys
presently in use.

The SHA-2 hashes may be used with RSA signing keys.

When the standard writers chnage things, then things will change. Doing so
before, breaks signature verification.

- --
John P. Clizbe                      Inet:   John (a) Mozilla-Enigmail.org
You can't spell fiasco without SCO. PGP/GPG KeyID: 0x608D2A10
"what's the key to success?"        / "two words: good decisions."
"what's the key to good decisions?" /  "one word: experience."
"how do i get experience?"          / "two words: bad decisions."

"Just how do the residents of Haiku, Hawai'i hold conversations?"
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.1rc1 (MingW32)
Comment: When cryptography is outlawed, b25seSBvdXRsYXdzIHdpbGwgdXNlIG
Comment: Be part of the £33t ECHELON -- Use Strong Encryption.
Comment: It's YOUR right - for the time being.
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iD8DBQFCE7lzHQSsSmCNKhARAnylAKDF8f9Oak9mtgL5lKhfRIyWQ5gCJQCfRRLg
E0TyCXU5ZA9fSAx4+/TTjBQ=
=rM5c
-----END PGP SIGNATURE-----