Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Recommended hash algorithms #232

Open
tarcieri opened this issue Feb 9, 2021 · 3 comments
Open

Recommended hash algorithms #232

tarcieri opened this issue Feb 9, 2021 · 3 comments

Comments

@tarcieri
Copy link
Member

tarcieri commented Feb 9, 2021

Following up from RustCrypto/meta#10, this is an issue for discussion potentially adding "recommended" badges to certain algorithms in this repo:

Recommended: Yes

@tarcieri
Copy link
Member Author

tarcieri commented Feb 9, 2021

Here are my votes for algorithms to recommend or not recommend:

Recommended

  • blake2
  • sha2
  • sha3

I would've added k12 to this list as it's a fine, modern hash function, however our implementation of it is not great right now and I'm loathe to add a recommended badge to it until it is.

Note that there are many other hash algorithms we support which are secure and have decent implementations, but they are obscure/niche and I'd suggest only adding the badge to preferred, modern algorithms people should be selecting for greenfield development today.

NOT Recommended

I think we should add this badge to the following algorithms which are known to be cryptographically broken:

  • md2
  • md4
  • md-5
  • sha-1

@newpavlov
Copy link
Member

I wonder if we should recommend BLAKE3 over BLAKE2. Also I am not sure if we should have both k12 and sha3 on the same recommendation list.

@tarcieri
Copy link
Member Author

tarcieri commented Feb 9, 2021

Since "recommending" in this case would involve placing a badge on the corresponding crate's README.md, it's not really possible for us to do that as the blake3 crate is external to our org. However, we do already link to it from the toplevel README.md, and could maybe update that mention to say it's a recommended algorithm.

Regarding k12, that's not really an issue unless we actively recommend it, which I wouldn't recommend doing until the implementation quality is improved.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants