{"id":104971,"date":"2022-08-30T15:36:43","date_gmt":"2022-08-30T13:36:43","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/v-fedora-linux-39-planiruyut-po-umolchaniyu-otklyuchit-podderzhku-podpisej-na-osnove-sha-1"},"modified":"2022-08-30T15:36:43","modified_gmt":"2022-08-30T13:36:43","slug":"v-fedora-linux-39-planiruyut-po-umolchaniyu-otklyuchit-podderzhku-podpisej-na-osnove-sha-1","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/v-fedora-linux-39-planiruyut-po-umolchaniyu-otklyuchit-podderzhku-podpisej-na-osnove-sha-1","title":{"rendered":"In Fedora Linux 39, support for SHA-1-based signatures is planned to be disabled by default.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
The Fedora project developers have outlined a plan to disable support for digital signatures based on the SHA-1 algorithm in Fedora Linux 39. This disabling means that signatures using SHA-1 hashes will no longer be trusted (SHA-224 will be stated as the minimum supported in digital signatures), while support for HMAC with SHA-1 will remain, allowing for the LEGACY profile with SHA-1 to be enabled. After these changes are applied, the OpenSSL library will by default block the generation and verification of signatures with SHA-1. <\/p>\n
The disconnection will be carried out in several stages: In Fedora Linux 36, signatures based on SHA-1 will be excluded from the 'FUTURE' policy, a test policy TEST-FEDORA39 will be provided to disable SHA-1 at the user's discretion (update-crypto-policies --set TEST-FEDORA39), and warnings will be displayed in the log when creating and verifying SHA-1 based signatures. During the preparation for the release of Fedora Linux 38, a policy prohibiting the use of SHA-1 based signatures will be applied in the rawhide repository prior to the beta version formation, but this change will not be applied in the beta release and release of Fedora Linux 38. In the release of Fedora Linux 39, the policy to end support for SHA-1 based signatures will be applied by default. <\/p>\n
The proposed plan has not yet been reviewed by the FESCo (Fedora Engineering Steering Committee), which is responsible for the technical aspects of Fedora distribution development. The discontinuation of SHA-1-based signatures is prompted by the increasing effectiveness of collision attacks with a specified prefix (the cost of finding a collision is estimated to be several tens of thousands of dollars). In browsers, certificates signed using the SHA-1 algorithm have been marked as insecure since mid-2016. \n Source: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"