diff options
Diffstat (limited to 'src/share/keytrans')
| -rwxr-xr-x | src/share/keytrans | 17 |
1 files changed, 11 insertions, 6 deletions
diff --git a/src/share/keytrans b/src/share/keytrans index f9288fa..c47ccdc 100755 --- a/src/share/keytrans +++ b/src/share/keytrans @@ -426,7 +426,7 @@ sub pem2openpgp { my $uid = shift; my $args = shift; - $rsa->use_sha1_hash(); + $rsa->use_sha256_hash(); # see page 22 of RFC 4880 for why i think this is the right padding # choice to use: @@ -442,7 +442,7 @@ sub pem2openpgp { # RSA my $pubkey_algo = pack('C', $asym_algos->{rsa}); # SHA1 - my $hash_algo = pack('C', $digests->{sha1}); + my $hash_algo = pack('C', $digests->{sha256}); # FIXME: i'm worried about generating a bazillion new OpenPGP # certificates from the same key, which could easily happen if you run @@ -497,11 +497,14 @@ sub pem2openpgp { $ciphers->{tripledes} ); - # prefer SHA-1, SHA-256, RIPE-MD/160 - my $pref_hash_algos = pack('CCCCC', 4, $subpacket_types->{preferred_digest}, - $digests->{sha1}, + # prefer SHA-512, SHA-384, SHA-256, SHA-224, RIPE-MD/160, SHA-1 + my $pref_hash_algos = pack('CCCCCCCC', 7, $subpacket_types->{preferred_digest}, + $digests->{sha512}, + $digests->{sha384}, $digests->{sha256}, - $digests->{ripemd160} + $digests->{sha224}, + $digests->{ripemd160}, + $digests->{sha1} ); # prefer ZLIB, BZip2, ZIP @@ -687,6 +690,8 @@ sub openpgp2ssh { my $foundfpr = fingerprint($pubkey, $timestamp); my $foundfprstr = Crypt::OpenSSL::Bignum->new_from_bin($foundfpr)->to_hex(); + # left-pad with 0's to bring up to full 40-char (160-bit) fingerprint: + $foundfprstr = sprintf("%040s", $foundfprstr); # is this a match? if ((!defined($fpr)) || |