Support signature hashes other than SHA1

[alethea]

Given that SHA1 collisions have been discovered it would be nice to be able to allow the server implementing the signing function to use a stronger hash function.

[tresf]

Agreed however rest assured that our messages are only valid for 15 minutes and a valid SHA1 collision takes 6,610 single-CPU years and 110 single-GPU years and our messages are clear-text, so an attacker planning a collision would not only have to have a super computer, but also the message would have to be constructed as a huge padded JSON message with the hopes that the filler content doesn't actually overflow or break something in its path.

We'll keep this open so that we can add a stronger hash (or collision avoidance) algorithm down the road, but until a valid use-case is brought to light, this will remain on the back burner.

[alethea]

Yeah, agreed, just figured it was worth putting in the radar. I only discovers this by typing SHA256 out of muscle memory. 😂

[tresf]

Stronger hashes introduced in https://github.com/qzind/tray/pull/525, to be merged to 2.1 branch very soon.

Edit: The API is as follows:

qz.security.setSignatureAlgorithm('SHA1'); // SHA1|SHA256|SHA512

Naturally all back-end controllers need to be modified to calculate the matching hash, so we've updated all of our signing examples in the PR.

The new recommended hashing algorithm with 2.1 is SHA512 do to it's documented performance benefits on 64-bit systems over SHA256.