Re: Crypto agility in SCRAM + draft-josefsson-password-auth?

[Nicolas Williams <Nicolas.Williams@xxxxxxx>]

On Tue, Mar 18, 2008 at 04:40:03PM +0100, Simon Josefsson wrote:
> I think our choice should be between HMAC-SHA-1 and HMAC-SHA-256.  I

I agree.

> don't think there are strong technical reasons to chose one over the
> other at this point.  I used HMAC-SHA-256 for password-auth.

Well, I think there are strong reasons to prefer SHA-256 over SHA-1: the
existence of more attacks against SHA-1, the fact that SHA-1 will be
considered obsolete in ~two years time.

The main reason for preferring SHA-1 over SHA-256 is that
implementations of the former are probably more widely available than of
the latter.

We can always specify multiple hash functions, make SHA-1 and SHA-256
MUST implement and RECOMMEND SHA-256.  This means that implementors
without suitable SHA-256 libraries will be "non-compliant" but their
code will still be deployable, but at least we get a future-proof
mechanism (for some values of "future-proofing").

Nico
--