# Signing Key Insecure?

**URL:** https://forum.torproject.org/t/signing-key-insecure/20373
**Category:** Core Tor
**Tags:** debian
**Created:** [August 12, 2025, 8:00am UTC](https://forum.torproject.org/t/signing-key-insecure/20373 "2025-08-12T08:00:53Z")
**Posts on this page:** 1
**Showing post:** 3

<div class="post-metadata">

### Author: ![Protium\_serratum](https://forum.torproject.org/letter_avatar_proxy/v4/letter/p/eb8c5e/32.png) [@Protium\_serratum](https://forum.torproject.org/u/Protium_serratum)
#### Post date: [August 12, 2025, 5:35pm UTC](https://forum.torproject.org/t/signing-key-insecure/20373/3 "2025-08-12T17:35:52Z")

</div>

> Signing Key Insecure?

The Tor team is using at least 3 message-digest algorithms (SHA256, SHA1, MD5), some of them, SHA1 and MD5 are not considered secure.  
`view-source:https://deb.torproject.org/torproject.org/dists/trixie/InRelease`

> [@BobbyB](#):
>
> > [@g0l4](#):
> >
> > SHA1 is not considered secure since 2026-02-01T00:00:00Z
> 
> Today is 2025-08-12; 2026 is in the future. A typo maybe?
> 
> [NIST Retires SHA-1 Cryptographic Algorithm | NIST](https://www.nist.gov/news-events/news/2022/12/nist-retires-sha-1-cryptographic-algorithm)

Package manager APT said “Policy **will** reject signature **within a year** , see --audit for details”

---

_[View the full topic](https://forum.torproject.org/t/signing-key-insecure/20373)._