Key Transition Letter 2009-05-21

Robert J. Hansen rjh at
Sun May 24 08:15:39 CEST 2009

webmaster at wrote:
> i don't think this is correct. See:

It depends on what sort of threat you're facing.  In this case, the MD5
attack is predicated on the victim signing documents they did not
originate.  This is often considered bad policy, since it tends to
facilitate attacks like this.  This usage case is kind of rare for GnuPG
-- not unheard of, but rare.

MD5 is best avoided, yes, please don't get me wrong -- but it's kind of
a stretch to say that it is entirely broken for purposes of email

More information about the Gnupg-users mailing list