search

pubsubhubbub / PubSubHubbub

The PubSubHubbub protocol specification.
http://pubsubhubbub.github.io/PubSubHubbub
602 stars 122 forks source link

PuSH 0.4 recommends old SHA1 signatures #40

Closed aaronpk closed 7 years ago

aaronpk commented 8 years ago

Right now the spec says signatures for authed pings must be SHA1. http://pubsubhubbub.github.io/PubSubHubbub/pubsubhubbub-core-0.4.html#authednotify

Given that SHA1 is deprecated, it would seem a new solution is needed for the spec. I'm not sure the best step forward, since simply updating it to use SHA256 will likely encounter the same problem in a few years. Maybe going the route that JWT took where there is another property that indicates the signature method, so the spec doesn't have to change to support new crypto functions? On the other hand that would seem to lead to less interoperable solutions since clients couldn't guarantee availability of a specific signature method.

voxpelli commented 8 years ago

As the signature is specified as 'sha1=signature' it would just be a matter of the spec allowing other algorithm names in there and then perhaps provide a mechanism for negotiating what algorithm to use by perhaps the subscriber telling the hub what algorithms it supports and the server picking the one it prefers amongst them?

aaronpk commented 7 years ago

Replaced by https://github.com/w3c/pubsubhubbub/issues/4