On Tue, 19 May 1998, Jon Callas wrote:
Do we really want to do this? Yes, it's a break with the past, but it's
also an opportunity to really deprecate MD5.
Opinions? I'm in a quandry.
Jon
I like Hal Finney's reply - Depricate a lack of a Hash: header (except
for the specific case of 2.6.2 backwards compatibility, where you would
also want a V3 RSA signing key and V3 signature packet).
The problem is there are lots of old messages, e.g. archived at Deja News,
not to mention in my mail folders that are of 2.6.2 vintage. Having a
onepass signature capability on the would be a good thing, but it would
require either doing both MD5 and SHA1 hashes when no Hash: header is
present, or trying one, and rewinding and doing the other if we picked the
wrong one. And current implementations that I know of all use Hash: SHA1
when they mean SHA1.