Re: [jira] Commented: (DERBY-4483) Provide a way to change the hash algorithm used by BUILTIN authentication

[Myrna van Lunteren]

On Tue, Mar 30, 2010 at 12:12 PM, Rick Hillegas (JIRA) <j...@apache.org> wrote:
>
>    [ 
> https://issues.apache.org/jira/browse/DERBY-4483?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=12851516#action_12851516
>  ]
>
> Rick Hillegas commented on DERBY-4483:
> --------------------------------------
>
> Hi Knut,
>
> I am not thrilled by using SHA-1 as the default algorithm. It is not 
> considered secure enough for use by the U.S. government as of this year; see 
> http://en.wikipedia.org/wiki/SHA_hash_functions I would prefer to see a 
> solution like this:
>
> 1) If the user specifies an algorithm, use it
>
> 2) Otherwise, try to use SHA-256
>
> 3) If SHA_256 isn't available, fall back on SHA-1
>
> 4) If even that isn't available, then raise an error
>
> What do you think?
>
> Thanks,
> -Rick
>
I'd like that approach...
Myrna