4 ms·

> CRC is now more valid use case than SHA1. That's the point of this announcement. No. That isn't the point of this announcement. This announcement codifies a

• Dylan16807 4y ago
  The point of the announcement is to give a timeline to start treating SHA1 as having no real security. This is relevant to when you'd choose CRC, because it also has no real security.
  • IncRnd 4y ago
    > The point of the announcement is to give a timeline to start treating SHA1 as having no real security. That's also false. There is a large body of knowledge here that you aren't expressing in your comments. That leads me to see that you are unfamiliar with the purposes of hash functions and their utility in real world situations. The announcement refers to the transition timeline to stop using SHA-1, preferring the SHA-2 and SHA-3 families. However, the recommendations for years from NIST have been not to use SHA-1. For example SP 800-131Ar2 discusses not to use SHA-1 for digital sig gen and that digital sig ver is only acceptable for legacy uses. The recommendation would have been for years to not use SHA-1 at all, except for this carve-out to handle already stored data that uses SHA-1. The remaining use cases cover protocol use, such as TLS, where SHA-1 is used as a component in constructs and not solely as a primitive.
    • Dylan16807 4y ago
      > That leads me to see that you are unfamiliar with the purposes of hash functions and their utility in real world situations. Don't post like this, please.