On Tue, Mar 08, 2022 at 07:40:15PM +0100, Alexander Sosedkin wrote:
the only realistic way to weed out its reliance on SHA-1 signatures
from all of its numerous dark corners is to break them.
Make creation and verification fail in default configuration.
That sounds like a terrible plan. We should make newer hashes
the default, and we can make tools print a warning if sha1 is used
where it shouldn't, but please don't break things on purpose.
For many many things sha1 is just fine. Just like md5 or even
crc32. Not everything is about cryptographic security.
Also, users will want to verify old signatures essentially forever.
This should be always possible. And finally, the world is huge,
and other users will provide sha1 signatures no matter what we do,
and it is better to check those than to completely ignore them.
Zbyszek
(This is a bit like browsers disliking self-signed certs and http://
— it certainly is OK to make users aware of the issue, but actually
disallowing those is terribly annoying and will only result in users
jumping to different tools.)