Re: [openpgp] Deprecating SHA1

[Phil Pennock <[e-mail]>]

On 2020-10-24 at 09:57 +0100, Jonathan McDowell wrote:
> On Fri, Oct 23, 2020 at 03:23:17PM -0400, Phil Pennock wrote:
> >     gpg --expert --cert-digest-algo SHA256 --sign-key $YourKeyId
> 
> I'm one of the people with a SHA1 self signature. I've been aware of it
> for some time, and it's been on my todo list to sort out, but when I
> last tried GPG did not make it possible. What version of GPG is
> necessary for the above to work? The somewhat aged versions on the
> airgapped machine my master key lives on do not seem to want to update
> the type of the self sig with that command.

[ not to list-cop, just to make sure that I'm not blindly taking this
  down a rat-hole not germane to the IETF list, since I'm the one who
  raised GnuPG in the first place: ]
Since this affects the ease of a deprecation, I'm considering this
on-topic enough for me to reply here; if the follow-ups are specific to
GnuPG, then gnupg-users might be a better mailing-list?  If it's about
the real-world practicalities of migrating and the impact on IETF
standardization then perhaps not.

I see commit messages about "Honor --cert-digest-algo when recreating a
cert." from 2012:

  commit 2b3cb2ee94625498e7a7f939216c9bcddef6ec20
  Author: David Shaw
  Date:   Tue Jan 31 21:30:05 2012 -0500

  commit 60c58766aeb847b769372fa981f79abac6014500
  Author: Christian Aistleitner
  Date:   Sun Oct 14 20:30:20 2012 +0200

Using `git tag --contains $COMMIT_SHA`, it looks like gnupg-2.1.0
onwards include it.  If memory serves, there's an "odd minor is dev,
even minor is release" pattern used here, so 2.2 would have been the
first "real release" even though lots of places had 2.1 packaged.

<https://gnupg.org/download/> has an EOL table; GnuPG 1.4 is dead-end
with no support for modern algorithms; 2.0 started on 2006-11-11 and
reached EOL on 2017-12-31.  GnuPG 2.2 cites 2014-11-06.

If the modern GnuPG approach to partitioning up the work in managing a
keyring is of concern, then I suspect Neal will be happy to help with a
migration to Sequoia PGP.  :)

-Phil