URL:
https://github.com/SSSD/sssd/pull/837
Title: #837: p11_child: make OCSP digest configurable
dpward commented:
"""
But intention (perhaps wrong) was to get rid of sha-1 as much as
possible as its widespread deprecation feels anticipated.
@alexey-tikhonov Could I kindly point to [NIST SP
800-131A](https://www.nist.gov/publications/transitioning-use-cryptograph...
(March 2019)? According the abstract, it provides the "specific guidance for
transitions to the use of stronger cryptographic keys and more robust algorithms".
Please see Table 8 and especially the text below it:
SHA-1 for non-digital signature applications:
For non-digital-signature applications, the use
of SHA-1 is **acceptable** for applications that do not require collision resistance.
SHA-224, SHA-256, SHA-384, SHA-512, SHA-512/224, and SHA-512/256:
The use of these hash functions is **acceptable**
for all hash function applications.
SHA3-224, SHA3-256, SHA3-384, and SHA3-512:
The use of these hash functions is **acceptable**
for all hash function applications.
There is no indication here of SHA-1 being deprecated for *non-digital signature
applications*.
"""
See the full comment at
https://github.com/SSSD/sssd/pull/837#issuecomment-674963727