[tor-bugs] #26291 [Core Tor/Tor]: find all instances of SHA-1 in our design and implementation and kill them with fire

[Tor Bug Tracker & Wiki]

#26291: find all instances of SHA-1 in our design and implementation and kill them
with fire
-------------------------+-------------------------------------------------
     Reporter:  isis     |      Owner:  (none)
         Type:  project  |     Status:  new
     Priority:  Medium   |  Milestone:  Tor: unspecified
    Component:  Core     |    Version:
  Tor/Tor                |   Keywords:  sha1, crypto, technical-debt,
     Severity:  Normal   |  hidden-services, hash-functions
Actual Points:           |  Parent ID:
       Points:  9001     |   Reviewer:
      Sponsor:           |
  SponsorV-can           |
-------------------------+-------------------------------------------------
 This is a parent ticket for finding every use of SHA-1 in our specs/design
 and code, detailing it, and coming up with a plan to replace it.

 From
 [https://trac.torproject.org/projects/tor/wiki/org/meetings/2018NetworkTeamHackfestSeattle/OldCrypto
 the Seattle notes], we use truncated SHA-1 in v2 onion services and
 `relay_crypt_one_payload()`, and we use full width SHA-1 for relay
 fingerprints and, again, v2 onion services. Nick has also written
 [https://gitweb.torproject.org/torspec.git/tree/proposals/ideas/xxx-what-
 uses-sha1.txt a draft document] detailing where we use SHA-1, however it
 is presently outdated and incorrect in some places.

--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/26291>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online