Re: some feedback about security from the user's point of view
On Mon, 24 Jan 2011, René Mayrhofer wrote:
> Therefore, I strongly suggest to move away from all uses of MD5 and
> use SHA-2 (>=256) instead (SHA1 already makes the crypto community
No. Let's stick to SHA2-256, please. There are some doubts about how
well sha2-512 holds, it may actually be weaker than sha2-256 against
some attacks (not brute-force, obviously). It is also faster, and
secure enough for the next three years. There is no need to waste
resources with sha2-384 and sha2-512 for now.
And, if you're going to be paranoid, you really should check ALL
available hashes (so, if sha1, md5 and sha2-256 hashes are available,
check them all) and fail if any of them fail.
--
"One disk to rule them all, One disk to find them. One disk to bring
them all and in the darkness grind them. In the Land of Redmond
where the shadows lie." -- The Silicon Valley Tarot
Henrique Holschuh
Reply to: