From aca937ac842960e6f2946f609e7f6be6b6900374 Mon Sep 17 00:00:00 2001
From: kukutac <mateo.paulisic@gmail.com>
Date: Sun, 5 Jul 2026 17:54:29 +0200
Subject: [PATCH] Use RSA-SHA256 for fiscalization signatures

---
 fiskalhr/signature.py | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/fiskalhr/signature.py b/fiskalhr/signature.py
index 0fb429d..598d8ee 100644
--- a/fiskalhr/signature.py
+++ b/fiskalhr/signature.py
@@ -16,13 +16,13 @@
  <Signature xmlns="http://www.w3.org/2000/09/xmldsig#">
      <SignedInfo>
        <CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" />
-       <SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" />
+       <SignatureMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#rsa-sha256" />
        <Reference>
          <Transforms>
            <Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" />
            <Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
          </Transforms>
-         <DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" />
+         <DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256" />
          <DigestValue></DigestValue>
        </Reference>
      </SignedInfo>
@@ -126,7 +126,7 @@ def sign_zki_payload(self, data: str) -> str:
         """
         Sign raw ZKI payload using the private key
 
-        Payload is signed using SHA1+RSA algorithm. The signature is
+        Payload is signed using SHA256+RSA algorithm. The signature is
         hashed using MD5 digest algorithm. The resulting digest is
         returned as hexadecimal string.
 
@@ -144,7 +144,7 @@ def sign_zki_payload(self, data: str) -> str:
         signature = self.hazmat_key.sign(
             data.encode("utf-8"),
             padding.PKCS1v15(),
-            hashes.SHA1(),
+            hashes.SHA256(),
         )
         return md5(signature).hexdigest()