Description

When a new crypto signer is created, the hash function is hardcoded to SHA-256. This can be found on the following lines:

• timestamp-authority/pkg/signer/signer.go

  Line 47 in 4121517

  signer, err := kms.Get(ctx, kmsKey, crypto.SHA256)

• timestamp-authority/pkg/signer/signer.go

  Line 42 in 4121517

  sv, _, err := signature.NewECDSASignerVerifier(elliptic.P256(), rand.Reader, crypto.SHA256)

The signer should accept a hash function configured when the server is created.

Version