Re: hash tags

On Mar 8, 2013, at 5:02 PM, Christian Heimes <[email protected]> wrote:

> Am 08.03.2013 22:43, schrieb Daniel Holth:
>> Check out https://blake2.net/ ; it is both faster and more secure than
>> md5. md5 does have to go, no matter how secure it is in this
>> particular application. SHA2 is the only choice that doesn't require a
>> long explanation. When this came up a little less than a year ago we
>> talked about maybe including the SHA2 hash in one of the link
>> attributes <a href= something="hash"> for the benefit of old clients.
> 
> Let's not add yet another crypto hash algorithm. :)
> 
> We have SHA-1 and SHA-2, that's ought be be enough. SHA-3 is available
> for Python 3.4 and I provide stand-alone sources and binaries for 2.6 to
> 3.3. Blake2 looks nice but we should stick to NIST-approved algorithms.
> 
> The combination of file size, MD5 (for legacy reasons), SHA-1 and
> perhaps SHA-256 is more than sufficient. Don't forget that files have to
> be valid tar.gz, tar.bz2, zip or Windows binaries, too …

Sha-1 is broken. Sha-2 or better is the only real acceptable one in the stdlib.

> 
> Christian


-----------------
Donald Stufft
PGP: 0x6E3CBCE93372DCFA // 7C6B 7C5D 5E2B 6356 A926 F04F 6E3C BCE9 3372 DCFA

_______________________________________________
Catalog-SIG mailing list
[email protected]
http://mail.python.org/mailman/listinfo/catalog-sig

-----BEGIN PGP SIGNATURE-----
Version: GnuPG/MacGPG2 v2.0.19 (Darwin)

iQIcBAEBAgAGBQJROmAyAAoJEG48vOkzctz6cCMP/3MhfBxbAQdxwld6asrlmTth
maZI0z3WFlxYv4YlZ2ZJbUMhWBJezYF7PGrbsNZAW7COaO47SFFZyib7QNnnwxnr
8lFBCtl5TE6Hi2S66ZQmCDJTPM6WLYsRYR6bnDXgIfgp8vTqrq7ttrSm6dV0YfKY
8pybpolkD3tukuFqw7y2dKNR3zsbX4xBXDr9tXWig18/kXW3JSK4aVprKgq8Mgx7
7aAxzUpsMqHcrP2YGJ8Hg/iUnyteNFjK+ZQd20DfzbfUvxuIw3CT5DZw0LvwOIEJ
tqxg+kuom5Y5pKR7aFTAiVSucgYkDAQ+c8QeI2D5CCsbBo3JtAZIT3IxqMYjAGC+
Gmb13f3aX2L/ED2qGH96mSkE65PEeoRg/2c776w3kU2LXUyCblt1hsJOMbjGFNsA
wkJ14scNQ4epsP7xTE4sXdmD4Vn7hr9hRN9KWfEia2K7wBC1xNun4h2X6RffN4XB
YJt5icy3Ddh8urRaxVHPLiTPSeuFSz6aibm4I9g8wpudJ45gicjhnQxejMTnrkF2
xvddw0fE5XR3hlXuqWI1R8ValfmWH+al6eoHTN/vORcpV9zGbrahwALcT/4Z10Gz
UiMhEhM5X1TFCn8syifWEHb6q01gK1JuaWB0j85Szx6VuiS54F29+EuQ13Lka6FK
v95qg+V61diSkLSsrCO8
=8fo7
-----END PGP SIGNATURE-----