OK, so I see the way you’ve threaded the needle on this. Mostly, interop hinges on the presence of sha-256 as a commonly produced hash. Developers MAY emit other IANA-HASH function values. I am glad we eliminated SHOULD on this due to the
presence of a few long broken/little utilized functions in the list. It is a bit of a shame that we no longer document a reasonable set of names for other hashes, but if our canonical source for this is wiki, that doesn’t seem sufficient.
So, personally I am good with where this landed.
I just printed out Katrina’s crypto doc to read, thanks for posting that, Katrina!
From: <>
On Behalf Of Larry Golding (Comcast)
Sent: Thursday, April 12, 2018 12:08 PM
To:
Subject: [sarif] Change draft for #107 (hash functions)
Importance: High
I pushed a change draft for
Issue #107: Settle on a small set of hash functions:
Documents/ChangeDrafts/Active/sarif-v2.0-issue-107-hash-functions.docx
I’ll move its adoption at the next TC meeting.
This draft includes feedback from Jim on my original proposal. See the (long) discussion thread in the
issue for details.
Thanks,
Larry
