Re: [keyassure] Opening issue #21: "Need to specify which crypto

[Martin Rex <[e-mail]>]

Nicholas Weaver wrote:
> 
> I still don't get why SHA-384 instead of SHA-512.
> SHA-384 just seems silly to me: its no FASTER than SHA-512,
> it MUST be less secure than SHA-512.

There is no reason to this (in the sense of reasonable explanation).

It fosters on the premise that SHA-1 is completely and throroughly
broken and SHA-256 impaired by more serious attacks than currently
known for SHA-1 _long_ before a SHA-3 finalist is selected.


The only two situations, where *I* believe that having more than
one mandatory to implement hash algorithms for DANE would make sense:

  1)  when SHA-1 was permitted (which no one seems to be asking for)
  2)  when the SHA-3 winner has been determined (which hasn't happened yet)


Personally, I would strongly prefer the hash algorithm list for
DANE to be

   1)   SHA-256      (FIPS 180-3)    MUST implement
   2)   SHA-512      (FIPS 180-3)    SHOULD implement


Personally, I believe that SHA-384, and more so SHA-224 should have
never been defined by NIST, because they constantly confuse the
crypto-clueless about the purpose of these algorithms and cause
needless discussions.


-Martin