Re: UC fips compliant

Satchell Julian via reportlab-users wrote:
>
>
> SHA-1 is no longer recommended, as collision attacks on it are well 
> known. Minimum is something in the SHA2 family, depending on strength 
> / length requirement.
>
Well, you have to balance the cost against the risk.  With one 
exception, MD5 is not used in a security context within ReportLab.  It's 
just a hash algorithm.  There is no "attack vector", and there are no 
secrets being protected.  For those uses, even SHA1 is overkill, and 
SHA2 is vast overkill.

The one exception is creating a key for PDF encryption, and here they 
are restricted to the standard.  They can't arbitrarily change the 
algorithm.

-- 
Tim Roberts, [email protected]
Providenza & Boekelheide, Inc.