search

keybase / keybase-issues

A single repo for managing publicly recognized issues with the keybase client, installer, and website.
902 stars 37 forks source link

Code signing key uses an insecure hash algorithm #4207

Open cezmunsta opened 8 months ago

cezmunsta commented 8 months ago 
$ sudo rpm --import https://keybase.io/docs/server_security/code_signing_key.asc
warning: Signature not supported. Hash algorithm SHA1 not available.
error: https://keybase.io/docs/server_security/code_signing_key.asc: key 1 import failed.

At the least, this prevents use on RHEL 9.

GwynethLlewelyn commented 7 months ago

Huh.

I admit that I'm far from an expert in anything related to cryto, but I cannot find any references to SHA1 on Keybase's public PGP key. The only information I get is that the PGP key was generated using RSA (4096 bits) encryption, which sounds rather secure to me.

But maybe I don't really understand the complexity of the issue altogether.

What happens when you import Keybase's code-signing public key directly into the PGP keychain (i.e., not going through whatever internal processes RPM might be using)?

cezmunsta commented 7 months ago

@GwynethLlewelyn this is for package management, signing the package with a weak hashing algorithm and thus forcing the user to weaken the default crypto policy (and thus system), or disable signature checking during installs is not a good look.

The use of SHA-1 is restricted in the DEFAULT crypto policy. Except for HMAC, SHA-1 is no longer allowed in TLS, DTLS, SSH, IKEv2, DNSSEC and Kerberos protocols.