Minor security improvement
| From: | Remi Collet | Date: | Thu, 05 Aug 2021 12:04:08 +0000 |
| Subject: | Minor security improvement | ||
| Groups: | php.internals | ||
| Request: | Send a blank email to internals+get-115631@lists.php.net to get a copy of this message | ||
In phar default signature is still SHA-1
which is no more considered add secure
Proposal: switch to SHA256 by default
https://github.com/php/php-src/pull/7341
Old algo are not removed, at least they
are required to check old archives.
Perhaps could make sense to raise a warning
when used
In smp, auth protocol only support MD5 and SHA-1
rfc-7860 recommends SHA256 and SHA512
https://github.com/php/php-src/pull/7342
As minor self-contained change, probably don't
worth an RFC.
Please comment on PR
Remi