3 ms·
They do, with 1024bit DSA with SHA1. Cryptographically weak and forbidden by the NIST.
by dcbadacd 8y ago
They do, with 1024bit DSA with SHA1. Cryptographically weak and forbidden by the NIST.
- jjeaff 8y agoWhile yes, it is considered weak, that doesn't mean it is useless. Git uses Sha1 and a lot of other services do as well. Using it to validate and sign an update is probably still pretty much safe as I have only ever seen or heard of a single SHA1 collision ever. And that was in 2017. It took them 6500 years of CPU computation time and 110 years of GPU computation time to find it. I think we can consider SHA1 good enough to sign VLC updates for now. https://security.googleblog.com/2017/02/announcing-first-sha1-collision.html https://security.googleblog.com/2017/02/announcing-first-sha...