Ubuntu Working On SHA3 For Debian's APT For If/When SHA2 Is Broken

Ubuntu developer Gianpiero Carpinelli at Canonical has been working on introducing SHA3-256 and SHA3-384 support for Debian's APT packaging tool in preparing for if/when that SHA2 is broken.

There's been several mentions recently in various developer updates around Canonical working on SHA3 support for APT and this week it culminated with an open pull request for getting this SHA3-256 and SHA3-384 support into upstream APT. This allows SHA3 as an alternative to SHA2 in Release, Packages, and Sources when using new SHA3 options but not engaged by default.

The motivation is explained in the pull request over concern that the SHA2 standard could be broken before Ubuntu 24.04 LTS support ends in the year 2036. So to prepare for that likely eventuality, they are working now on getting SHA3 support rolled out and back-ported to Ubuntu 24.04 LTS so that they can be prepared should they ever need to change for better security:

"Motivation: Ubuntu 24.04 is supported for ten to twelve years. If SHA-2 is broken in that window, clients already deployed must understand a structurally different hash family so archives can move to it. OpenPGP signature digests are out of scope.
"

So far SHA2 has not been broken but there have been theoretical attacks that aren't applicable to real-world implementations.

Those interested in this SHA3 support being worked on for APT can see the Debian.org APT merge request.