[xml2rfc-dev] cryptographic signatures over xml2rfc releases should not be made with SHA1

[Daniel Kahn Gillmor <[e-mail]>]

Hi folks--

I'm looking at the latest xml2rfc tarball and its OpenPGP signature:

https://files.pythonhosted.org/packages/c0/81/21281e78fd2afb8f5dfcb92b78c9dcd621081277304e0f25df0ee7c89c64/xml2rfc-3.5.0.tar.gz
https://files.pythonhosted.org/packages/c0/81/21281e78fd2afb8f5dfcb92b78c9dcd621081277304e0f25df0ee7c89c64/xml2rfc-3.5.0.tar.gz.asc

The signature file (the *.asc) is made using SHA-1 for the signature:

    $ pgpdump  < xml2rfc-3.5.0.tar.gz.asc 
    Old: Signature Packet(tag 2)(540 bytes)
            Ver 4 - new
            Sig type - Signature of a binary document(0x00).
            Pub alg - RSA Encrypt or Sign(pub 1)
            Hash alg - SHA1(hash 2)
            Hashed Sub: signature creation time(sub 2)(4 bytes)
                    Time - Wed Nov 18 05:20:56 EST 2020
            Sub: issuer key ID(sub 16)(8 bytes)
                    Key ID - 0x4E9B574B8FBB171A
            Hash left 2 bytes - d2 9f 
            RSA m^d mod n(4094 bits) - ...
                    -> PKCS-1
    $

Signatures using SHA-1 have been deprecated for over a decade now.  No
modern tool should generate them.

From the Version: comment in the .asc file, it looks to me like these
signatures are being generated from the old, deprecated "classic"
version of GnuPG ("Version: GnuPG v1").

Henrik (or whoever else might make a future release of xml2rfc), is
there something blocking you from updating to a more modern OpenPGP
implementation for making these signatures?  The GnuPG 2.2.x series
("modern") should make signatures with sha256 (or better) by default, as
should pretty much any other OpenPGP implementation (sequoia,
openpgp.js, gopenpgp, rnp, pgpainless, etc).  There's probably also a
way to coax better-than-SHA-1 signatures out of GnuPG 1.x as well, but
that toolkit is unable to deal with modern tooling like ECC keys so i
recommend upgrading anyway.

The irony here is that i'm trying to work on the RFC for OpenPGP itself
to refresh the cryptographic requirements in that standard, and i'm
working with modern tooling that deprecates SHA-1 signatures
appropriately; and to update the xml2rfc package i want to check the
OpenPGP signature, etc.  a nice little loop!

I figure it's probably neither possible nor advisable to re-issue a
signature over xml2rfc version 3.5.0, but if you can line it up so that
signatures of future releases avoid using SHA1, that'd be great.

               --dkg

PS The files i've fetched from the above URLs have this content (just in
   case anyone wants to replicate, they can confirm that they're getting
   the same thing):

$ sha256sum *
3ec836a9545f549707a8c8176038160185b9d08c1dd80304a906527da21bff68  xml2rfc-3.5.0.tar.gz
ef652fda6c1f7b63f22765e7df48d627ce529155f1bcb45a01e566687b4fd4eb  xml2rfc-3.5.0.tar.gz.asc
$