Skip to content

Specify sha256 in TSA request#1373

Merged
jku merged 8 commits into
sigstore:mainfrom
ramonpetgrave64:tsa-verify-sha
May 9, 2025
Merged

Specify sha256 in TSA request#1373
jku merged 8 commits into
sigstore:mainfrom
ramonpetgrave64:tsa-verify-sha

Conversation

@ramonpetgrave64

@ramonpetgrave64 ramonpetgrave64 commented May 8, 2025

Copy link
Copy Markdown
Contributor

Client support for Rekor V2: sigstore-python

Summary

Resolves #1372

Makes the TSA request specify sha256 for the message digest, since verification currently assumes sha256. Verification shouldn't assume any specific algorithm, but I think for signing requests this library should specify an algorithm, for the sake of predictability.

Release Note

  • TSA: Changed the Timestamp Authority requests to explicitly use sha256 for message digests.

Documentation

Signed-off-by: Ramon Petgrave <ramon.petgrave64@gmail.com>
Signed-off-by: Ramon Petgrave <ramon.petgrave64@gmail.com>
Signed-off-by: Ramon Petgrave <ramon.petgrave64@gmail.com>
Signed-off-by: Ramon Petgrave <ramon.petgrave64@gmail.com>
Signed-off-by: Ramon Petgrave <ramon.petgrave64@gmail.com>
@ramonpetgrave64 ramonpetgrave64 changed the title Tsa verify sha Specify sha256 in TSA request May 8, 2025
ramonpetgrave64 and others added 2 commits May 8, 2025 19:37
Signed-off-by: Ramon Petgrave <ramon.petgrave64@gmail.com>
@ramonpetgrave64

Copy link
Copy Markdown
Contributor Author

@DarkaMaul

@jku

jku commented May 9, 2025

Copy link
Copy Markdown
Member

Makes the TSA request specify sha256 for the message digest, since verification currently assumes sha256.

I mentioned this in the issue but for completeness will repeat: I think we should fix verification directly since we can't just support timestamps made by sigstore-python so can't enforce which algorithms we will see. trailofbits/rfc3161-client#144 may be something usable?

@ramonpetgrave64

Copy link
Copy Markdown
Contributor Author

@jku I agree. Verification shouldn't assume any specific algorithm, but I think for signing requests this library should specify an algorithm, for the sake of predictability.

@jku

jku commented May 9, 2025

Copy link
Copy Markdown
Member

@jku I agree. Verification shouldn't assume any specific algorithm, but I think for signing requests this library should specify an algorithm, for the sake of predictability.

Oh yeah that is a better reason for this PR than "verification currently assumes sha256". SGTM.

@jku

jku commented May 9, 2025

Copy link
Copy Markdown
Member

/gcbrun

@jku jku left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I agree, we should be choosing the algorithm explicitly when creating a timestamp. SHA-256 sounds fine to me and we can always bump that up (preferably after verification is ok with it).

I'll file a new issue for the verification hash being hard coded so we don't forget

@jku jku merged commit 572ccac into sigstore:main May 9, 2025
23 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

TSA request message digest defaults to sha256

2 participants