Re: [RFC PATCH] Add SHA1 support

2020-02-20 Thread Sebastian Andrzej Siewior via rsync
On 2020-02-20 20:06:39 [+0100], Markus Ueberall wrote:
> On 2020-02-09 23:19, Sebastian Andrzej Siewior wrote:
> > [...]
> > My primar motivation to use SHA1 for checksumming (by default) instead
> > of MD5 is not the additional security bits but performance. On a decent
> > x86 box the SHA1 performance is almost the same as MD5's but with
> > acceleration it outperforms MD5.
> > 
> > The other alternative would be to go for xxHash64 [0] which has the
> > superior performance but provides a non-cryptographic hash so I though
> > SHA1 would be better here.
> > [...]
> 
> With respect to *both* speed and security, wouldn't BLAKE3 be a better,
> modern alternative if we're looking at checksumming?
> It's "[r]eleased into the public domain with CC0 1.0. Alternatively, it is
> licensed under the Apache License 2.0".  And the performance (see the chart
> at https://github.com/BLAKE3-team/BLAKE3) is *impressive* ...

I'm still not sure if rsync requires a cryptographic hash _or_ if a
strong hash like xxHash64 would be just fine for the job.

> Kind regards, Markus

Sebastian

-- 
Please use reply-all for most replies to avoid omitting the mailing list.
To unsubscribe or change options: https://lists.samba.org/mailman/listinfo/rsync
Before posting, read: http://www.catb.org/~esr/faqs/smart-questions.html


Re: [RFC PATCH] Add SHA1 support

2020-02-20 Thread Markus Ueberall via rsync

On 2020-02-09 23:19, Sebastian Andrzej Siewior wrote:

[...]
My primar motivation to use SHA1 for checksumming (by default) instead
of MD5 is not the additional security bits but performance. On a decent
x86 box the SHA1 performance is almost the same as MD5's but with
acceleration it outperforms MD5.

The other alternative would be to go for xxHash64 [0] which has the
superior performance but provides a non-cryptographic hash so I though
SHA1 would be better here.
[...]


With respect to *both* speed and security, wouldn't BLAKE3 be a better,
modern alternative if we're looking at checksumming?
It's "[r]eleased into the public domain with CC0 1.0. Alternatively, it 
is
licensed under the Apache License 2.0".  And the performance (see the 
chart

at https://github.com/BLAKE3-team/BLAKE3) is *impressive* ...

Kind regards, Markus

--
Please use reply-all for most replies to avoid omitting the mailing list.
To unsubscribe or change options: https://lists.samba.org/mailman/listinfo/rsync
Before posting, read: http://www.catb.org/~esr/faqs/smart-questions.html