Red Hat Security Blog: November 2010 archives

  • Why Red Hat Enterprise Linux 6 has a new package signing key

    Starting with Red Hat Enterprise Linux 6 we have switched to using SHA-256 signatures on all RPM packages and to a 4096-bit RSA signing key. We've done this because it is current best practice to migrate away from MD5 and SHA-1 hashes due to various flaws found in them. Those flaws don't yet directly pose a threat to package signing however, and therefore our existing shipped products which used these older hashes will continue to use their existing keys until they reach their end of life. A...
    Posted 2010-11-11T00:00:00+00:00 - 0