⬇ Download holy card: ·
Saint SHAmbles, Who Forged the Signatures With SHA-1
Patron of digital signatures still clinging to SHA-1, chosen-prefix collisions, and everyone who has not yet changed algorithm.
Life
On 25 November 2019 Gaëtan Leurent and Thomas Peyrin presented SHAmbles, the first practical chosen-prefix collision on SHA-1: they could build two documents with different contents but the same SHA-1 digest, at a cost that had become affordable. They proved it by forging PGP signatures and creating counterfeit GnuPG keys. GnuPG fixed it by rejecting the problematic SHA-1 signatures from version 2.2.18 (CVE-2019-14855).
Prayer
O Saint SHAmbles, who gives the same fingerprint to different documents, let our signatures abandon SHA-1 once and for all. Amen.
How to celebrate
Celebrated by updating GnuPG past 2.2.18 and migrating signatures to SHA-256 and beyond.
Two papers, one fingerprint: trusting it is a gamble.