multiformats / multiformats/multicodec

missing several variations of sha2

Open
#205 3 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Python
Stars
383
Forks
221
Avg merge
24d 6h
Merged PRs (30d)
1

Description

The multiformats table seems to be missing several variations of sha2. Specifically:

  • sha2-224
  • sha2-384
  • sha2-512-224
  • sha2-512-256

See the excellent comparison chart in Wikipedia for more details here: https://en.wikipedia.org/wiki/SHA-2#Comparison_of_SHA_functions

Or I've lifted just the most relevant rows in a screenshot here for ease of reference:

Comparison of SHA2 functions

I'm especially interested in getting sha2-384 into the table, because it's both widely available and offers some innate defenses against length extension attacks (unlike the sha2 variants we currently have in the table, which both offer none!). But all four of these are well-standardized and deserve an indicator number in the multiformats table.


Naming notes:

  • Most documents seem to refer to these as e.g. "sha-224" rather than "sha2-224". However, most of the multiformat table seems to prefix things with the family name, so I suppose we should say "sha2-224" to continue that pattern.
  • Most documents seem to refer to the latter two as e.g. "sha-512/224" (with a slash). However, most of the multiformat table seems to prefer dashes for separations, so I suppose we should say "sha2-512-224" to continue (both) patterns.

Language library availability notes:

In golang, all of these are available in the standard library (as sha256.New224, sha512.New384, sha512.New512_224, and sha512.New512_256 respectively).

In javascript, in the browser, taking the Mozilla docs for SubtleCrypto.digest as a reference, SHA-384 is widely available.


I'll file a PR for this soon, but first, a couple questions:

  • Four new numbers are needed for this. Is it preferred to look for the first range where I can find four new consecutive numbers? Or should I stuff two in the first open range, and the other two later?
  • Am I doing the naming conventions correctly?

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by reviewing the multiformats table and the SHA-2 comparison referenced in the issue. Decide how the four names should follow existing table conventions and where their indicator numbers belong; done means all four standardized variants are represented consistently in the table.

Written by the indexing model from the issue text.

Assessment

Domain
cryptography
Issue type
Feature
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
42/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.