Re:It's Dangerous, a Python cryptographic signing module
by the_mitsuhiko on Sunday June 10, 2012 @09:26PM
(#4092828)
> SHA256
As it is, the size of that digest is also 14 bytes more and I don't feel happy truncating the hash. The bigger SHA2 versions are even longer. Considering that thing should go into cookies and URLs I did not feel very happy with that.
> You would indeed be better off using SHA256.
Probably. I was indeed under the impression that SHA2 is based on the same building blocks as SHA1 but I assume that is not the case. That being said: upgrading is not hard if it even comes to the point where it would be necessary.
Re:It's Dangerous, a Python cryptographic signing module
by tptacek on Sunday June 10, 2012 @09:33PM
(#4092841)
Do you really want to be the guy promoting a message verification library who won't use SHA-2 because of the extra 14 bytes of digest length? You made a design mistake here. Just fix it.
Re:It's Dangerous, a Python cryptographic signing module
by marcinw on Sunday June 10, 2012 @09:53PM
(#4092892)
Neils Ferguson, et. al of Cryptography Engineering (p. 95) suggest that truncating a HMAC-SHA-256 to 128 bits should be safe, given current knowledge in the field.
Re:It's Dangerous, a Python cryptographic signing module
by tptacek on Sunday June 10, 2012 @10:00PM
(#4092904)
This is code that's mostly going to be used in Python web apps (if at all). I thought about arguing in favor of truncating the hash, but then figured this guy would just say "well, I'm not so sure, so to be on the safe side... [I'll use an inferior hash]"... a better argument is, just eat the extra bytes and stick them on your message.
You would indeed be better off using SHA256.
But not much. It's worth pointing out though that dogmatism around not using SHA-1 is misplaced. There are still no practical attacks on HMAC-MD5, for instance, even though MD5 itself is effectively broken and its use in (for instance) X.509 certificates is insecure.