Problem - Kevin Tafuro

See Also
Recipes 6.7, 6.8, 6.12
6.2 Deciding Whether to Support Multiple
Message Digests or MACs
Problem
You need to figure out whether to support multiple algorithms in your system.
Solution
The simple answer is that there is no right answer, as we discuss next.
Discussion
Clearly, if you need to support multiple algorithms for standards compliance or legacy
support, you should do so. Beyond that, there are two schools of thought. The
first school recommends that you support multiple algorithms in order to allow users
to pick their favorite. The other benefit of this approach is that if an algorithm turns
out to be seriously broken, supporting multiple algorithms can make it easier for
users to switch. The second school of thought points out that the reality is if an algorithm
is broken, many users will never switch, so that’s not a good reason for providing
options. Moreover, by supporting multiple algorithms, you risk adding
additional complexity to your application, and that can be detrimental. In addition,
if there are multiple interoperating implementations of a protocol you’re creating,
often other developers will implement only their own preferred algorithms, potentially
leading to major interoperability problems.
We personally prefer picking a single algorithm that will do a good enough job of
meeting the needs of all users. That way, the application is simpler to comprehend,
and there are no interoperability issues. If you choose well-regarded algorithms, the
hope is that there won’t be a break that actually impacts end users. However, if there
is such a break, you should make the algorithm easy to replace. Because cryptographic
hash functions and MACs tend to have standard interfaces, that is usually
easy to do.
Besides dedicated hash algorithms such as SHA1 (Secure Hash Algorithm 1) and
MD5 (Message Digest 5 from Ron Rivest), there are several constructs for turning a
block cipher into a cryptographic hash function. One advantage of such a construct
is that block ciphers are a better-studied construct than hash functions. In addition,
needing fewer cryptographic algorithms for an application can be important when
pushing cryptography into hardware.
Deciding Whether to Support Multiple Message Digests or MACs | 253
This is the Title of the Book, eMatter Edition
Copyright © 2007 O’Reilly & Associates, Inc. All rights reserved.