search

LibraryOfCongress / bagit-spec

8 stars 7 forks source link

Be more specific than "SHA-2 family" #6

Closed zimeon closed 6 years ago

zimeon commented 6 years ago

I don't think it makes sense to say "SHA-2 family" in a normative statement about digests that MUST be supported. I think the intention is to mandate support for SHA-256 and SHA-512 (and not SHA-224 or SHA-384).

johnscancella commented 6 years ago

Hi @zimeon, Thanks for submitting this feedback. If you are already supporting SHA-256 and SHA-512, you will have hardware to supports SHA-224 or SHA-384 will you not? @acdha thoughts?

zimeon commented 6 years ago

I agree that implementions could support other SHA-2 family digests but they are not mentioned in the list of normalized names. But perhaps more importantly, I think the term "SHA-2 family" is too vague for a normative statement about what algorithms MUST be supported.

acdha commented 6 years ago

Good idea - let’s list the two we most care about even though most implementations can trivially support others