I recently became aware of an issue when using 32 bit key hashes to receive gpg keys. It's insecure to do so because it is now trivial to create colliding keys with the same 32 bit hash.
As a demonstration the following key hash for the R package maintainers has been duplicated by a colliding key. This can be shown by running the following command.
sudo apt-key adv --keyserver keyserver.ubuntu.com --recv-keys E084DAB9
Executing: /tmp/tmp.CTf53pBy3y/gpg.1.sh --keyserver
keyserver.ubuntu.com
--recv-keys
E084DAB9
gpg: requesting key E084DAB9 from hkp server keyserver.ubuntu.com
gpg: key E084DAB9: "Totally Legit Signing Key <mallory@example.org>" not changed
gpg: key E084DAB9: "Michael Rutter <marutter@gmail.com>" not changed
gpg: Total number processed: 2
gpg: unchanged: 2
Note the second Totally Legit Signing Key
.
See https://evil32.com/ for more information about the problem.
There are many questions with answers that include 32 bit keys in them, and many people are likely to copy and paste them without noticing a problem.
Is it appropriate to go through and directly edit all of those questions and answers to include the new stronger hashes?
It's very similar to this question Editing of Insecure Code Examples but I it seems like a distinct circumstance because it's a very targeted change, just substitute the new better key hash for the old bad one rather than a more general code change.