Re: Fedora 12 sha1sum

Wolfgang S. Rupprecht wrote:
Woudld it be possible to do the signature using SHA256 also? On one
of the iso's I recently burned did have a checksum file with a gpg
SHA256 signature hash. That was enough to remind me that I should
be using the SHA256 for checksumming the iso.

Yes, that is generally a goal. The F-11 *-CHECKSUM files were signed
using a SHA-256 hash. One unfortunate effect of moving to the Sigul
signing server for F-12 is that controlling the hash used for gpg
signatures is more difficult and resulted in the default SHA-1 being
used.

However, while using SHA-256 every where is the goal, it's still good
to make people aware that the GPG Hash: header and the checksum used
for the .iso are not related at all. It seems that far too many
people make the mistaken assumption that they are. :/

--
Todd OpenPGP -> KeyID: 0xBEAF0CE3 | URL: www.pobox.com/~tmz/pgp
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
The trouble with being punctual is that nobody's there to appreciate
it.
-- Franklin P. Jones

Attachment: pgpt2DilctwWv.pgp
Description: PGP signature

--
fedora-list mailing list
fedora-list@xxxxxxxxxx
To unsubscribe: https://www.redhat.com/mailman/listinfo/fedora-list
Guidelines: http://fedoraproject.org/wiki/Communicate/MailingListGuidelines

Relevant Pages

  • Re: GPG Question on Symmetric Key Input
    ... GPG does not allow this. ... input a symmetric key into GPG. ... GPG and PGP use a hash on the symmetric key you enter, ... best reason for hashing your keystrokes is because ...
    (comp.security.pgp.discuss)
  • Re: Generating PGP keys Was:attached messages
    ... with gpg sigs embedded in the body of an email. ... undo does work...) ... Insert info on where to find my public key and create an ascii hash ... coded signed copy of the spell checker output in another repetitively ...
    (Fedora)
  • Re: About Hsiehs hash: initial value? 64 bit?
    ... when implementing Paul Hsieh's hash for incremental updates? ... Well if you just want to use it as a checksum, ... CRCs of course, have a much longer history as checksums. ...
    (comp.programming)
  • Re: GPG Question on Symmetric Key Input
    ... Not the session key, ... The hash is easy to duplicate. ... The *passphrase* is an iterated hash of the password. ... PGP or GPG securely is keeping your private key secure. ...
    (comp.security.pgp.discuss)
  • Re: Really fast checksum?
    ... Using JDBC, I select records from a table, roll through them, calculate a checksum on the text of all of the fields, and then check it against a stored checksum to see if the record has changed. ... In the past I've used CRC32, but that only operates on bytes and I'd rather not convert all the strings I'll get from JDBC into bytes. ... No hash function, of any kind, is capable of giving you that guarantee. ...
    (comp.lang.java.programmer)