URL: https://github.com/SSSD/sssd/pull/837 Title: #837: p11_child: make OCSP digest configurable
dpward commented: """ > But intention (perhaps wrong) was to get rid of sha-1 as much as possible as > its widespread deprecation feels anticipated. @alexey-tikhonov Could I kindly point to [NIST SP 800-131A](https://www.nist.gov/publications/transitioning-use-cryptographic-algorithms-and-key-lengths) (March 2019)? According the abstract, it provides the "specific guidance for transitions to the use of stronger cryptographic keys and more robust algorithms". Please see Table 8 and especially the text below it: > SHA-1 for non-digital signature applications: > For non-digital-signature applications, the use of > SHA-1 is **acceptable** for applications that do not require collision > resistance. > SHA-224, SHA-256, SHA-384, SHA-512, SHA-512/224, and SHA-512/256: > The use of these hash functions is **acceptable** for > all hash function applications. > SHA3-224, SHA3-256, SHA3-384, and SHA3-512: > The use of these hash functions is **acceptable** for > all hash function applications. There is no indication here of SHA-1 being deprecated for *non-digital signature applications*. """ See the full comment at https://github.com/SSSD/sssd/pull/837#issuecomment-674963727
_______________________________________________ sssd-devel mailing list -- [email protected] To unsubscribe send an email to [email protected] Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedorahosted.org/archives/list/[email protected]
