#26291: find all instances of SHA-1 in our design and implementation and kill them with fire -------------------------+------------------------------------------------- Reporter: isis | Owner: (none) Type: project | Status: new Priority: Medium | Milestone: Tor: unspecified Component: Core | Version: Tor/Tor | Keywords: sha1, crypto, technical-debt, Severity: Normal | hidden-services, hash-functions Actual Points: | Parent ID: Points: 9001 | Reviewer: Sponsor: | SponsorV-can | -------------------------+------------------------------------------------- This is a parent ticket for finding every use of SHA-1 in our specs/design and code, detailing it, and coming up with a plan to replace it.
From [https://trac.torproject.org/projects/tor/wiki/org/meetings/2018NetworkTeamHackfestSeattle/OldCrypto the Seattle notes], we use truncated SHA-1 in v2 onion services and `relay_crypt_one_payload()`, and we use full width SHA-1 for relay fingerprints and, again, v2 onion services. Nick has also written [https://gitweb.torproject.org/torspec.git/tree/proposals/ideas/xxx-what- uses-sha1.txt a draft document] detailing where we use SHA-1, however it is presently outdated and incorrect in some places. -- Ticket URL: <https://trac.torproject.org/projects/tor/ticket/26291> Tor Bug Tracker & Wiki <https://trac.torproject.org/> The Tor Project: anonymity online
_______________________________________________ tor-bugs mailing list tor-bugs@lists.torproject.org https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs