TSA - update to SHA-2

[mxlbzn]

OpenSSL is still using rather obsolete SHA-1 in TSA (ts) code.

This pull request contains following changes:

• change the default message digest algorithm used in time-stamp query from sha1 to sha256 in ts app (apps/ts.c) (d4c5edc)
• change the time-stamp response (token) signature hash algorithm from sha1 to sha256 (crypto/ts/ts_rsp_sign.c) (71af5e7)
• update digests tsa section config value (default acceptable time-stamp query message digest algorithms) in sections from md5, sha1(!) to sha1, sha256, ... (apps/openssl.cnf, apps/openssl-vms.cnf) (ef86470)
• in tsa test suite, update these as well; add test to verify that unacepptable (by config) message algorithm in the time-stamp query causes failure time-stamp reply (686f6b8)
• fix misleading variable name (from $datafile to $confsection in create_time_stamp_response; probably relict from verify_time_stamp_response copy); fix typo in test msg string (from req3.req to req3.tsq) (the changeset as above)

[mxlbzn]

Note: sha1 usage is not completely eliminated by this PR. For now I have left it in openssl config tsa digests, together with sha-2 algorithms.

There's yet another usage of sha1, and that's ESSCertIDv1 (https://github.com/openssl/openssl/blob/OpenSSL_1_0_2d/crypto/ts/ts_rsp_sign.c#L845-L857). ESSCertIDv2 (rfc5816) allows using different hashes than sha1, but is not yet implemented. I did not examine thoroughly how widespread it currently is in trusted time-stamps.., our country's major QCA is providing trusted timestamps with sha256 signature algorithm, but still using v1 ESSCertID, i.e. sha1 hash as signer cert identifier.

[jariq]

Similar patch is waiting for inclusion since 2010. Good luck :)

[mxlbzn]

I was not aware of the patch. I like the idea of configurable option, it came to me as well. But I finally took more simple/conservative/lazy approach :)

[kroeckx]

I think this can now be closed?

[mxlbzn]

Yes, I think this can be closed. Please let me know if you want me to make another pull request with the test/recipes/80-test_tsa.t test.

[richsalz]

Can you please look at #771 and see if it meets your needs?