Hash selection failure on 2.1.1
dshaw at jabberwocky.com
Sun Jan 18 02:02:06 CET 2015
On Jan 17, 2015, at 5:48 PM, Robert J. Hansen <rjh at sixdemonbag.org> wrote:
> quorra:~ rjh$ grep default-pref .gnupg/gpg.conf
> default-preference-list SHA256 RIPEMD160 AES256 CAMELLIA256 TWOFISH 3DES
> ... As I understand the way algorithms are selected, GnuPG uses the
> most-preferred algorithm in my list that is also present in the
> recipient's capability set. Since SHA-1 implicitly follows after SHA256
> and RIPEMD160, it has the lowest priority.
That's basically how it works for "personal-digest-preferences", but you're showing your "default-preference-list". They're very different. default-preference-list sets the default preferences for new keys and is not part of the digest choice when signing.
> By my understanding, GnuPG should start by trying SHA256 and discovering
> Raven doesn't advertise that as a capability. It should then try
> RIPEMD160 and see Raven advertises that, and thus it should use RIPEMD160.
Not in this case. That's a clearsigned message above, and so GnuPG has no way to know who your recipient is. If you were encrypting & signing, it could know based on the recipient key, but there is no "recipient key" for a signed (only) message. Without a recipient, there are no preferences for it to consult beyond stuff (personal-digest-preferences, usually) in your config file.
There are a bunch of steps GnuPG follows when selecting a digest for signing without a recipient, but outside of the cases when it is forced to use a particular algorithm (due to DSA size requirements, smartcard capabilities, or the like), the main steps are "If digest-algo is set, use that. Otherwise, if personal-digest-preferences is set, use that. Otherwise, use SHA-1."
Do you have a personal-digest-preferences (or even digest-algo) set in your config file?
More information about the Gnupg-users