Re: [keyassure] Opening issue #21: "Need to specify which crypto

[Martin Rex <[e-mail]>]

Paul Hoffman wrote:
> 
> Phillip Hallam-Baker wrote:
> >
> > 1) Make support for SHA2-256 and SHA2-384 REQUIRED
> > 2) Ensure that it is feasible to transition from use of SHA2
> >    to a new algorithm
> > 3) Deprecate use of MD2,MD4,MD5 and SHA1.
> 
> We disagree on #1 in that I don't think that requiring SHA-384 has any 
> practical value and adds a second code path where none is needed.
> 
> We agree only partially on #2. You keep saying "SHA2" when you probably 
> mean "SHA-256 and SHA-384". I agree that making the transition feasible 
> is good, and we already have that.
> 
> We disagree on #3, and deprecating crypto is a different issue than 
> mandating crypto.

I agree to all what Paul wrote.

Iff SHA-256 is to be a mandatory to implement hash for DANE, then
I see _no_ point in supporting SHA-1 at all (and saves us migration).


-Martin