What determines the clearsign hash algorithm used by GnuPG?
I wish to know, how to generate output with specific "Hash:" values ? say, SHA1 ?
To answer your question, use the --digest-algo SHA1
option.
As an example, here is a detached signature using SHA-256. I don't use --clearsign
, so I'm not going to try to cobble it together:
gpg -a -u 1F8E37BD --digest-algo SHA256 --output test.txt.sig --detach-sig test.txt
-a
produces the ASCII armour output. -u
selects the signing key among different keys. --digest-algo
selects the hash. --output
is the output filename. The input filename must be last option.
The list of hashes and their values are available in RFC 4880, Section 9.4. SHA-1 is 2, and SHA-256 is 8.
You can audit the signature with:
$ cat test.txt.sig | gpg --list-packets | grep "digest algo"
digest algo 8, begin of digest 05 94