Not quite sure if this belongs here or on the crypto board...

Hi :)

We are using hash functions, not for hashing passwords but for digital signatures.

Architecture is having one gateway who has to receive and verify many clients' messages.

Is there a "best practice" to "declare" which function to use? I am bringing here the debate we have so far.

Hard-Coded: pass Enum/String to the sign method, something like SignData(Byte[], HashAlgorithmName).

  • pros: readable, all sides expect same signature, which is defined by publisher
  • cons: well, hard coded

From Config: define the hash function used via configuration, then pass to Sign() function

  • pros: more robust, easy to update over time
  • cons: bad security. can be downgraded to a broken hash

Don't declare it at all (??): just let the framework decide the algorithm used. This may not be how it actually works in other languages / methods. In some legacy code, we use XML & X509 certificate compiled as a DLL. I've noticed differences in the algorithm used depending on the caller (.NET framework or Core), the output XML element just declares it as an attribute, and also the verifying code doesn't specify which algorithm, it just takes it from the attribute.

  • pros: by letting the framework decide for me, it'll always be the latest, strongest algorithm.
  • cons: i won't really know which one is being used...
  • 1
    Are you designing a custom protocol or data format? Avoid making things configurable, that's primarily going to lead to compatibility issues at best and downgrade attacks at worst. Instead, select the strongest appropriate algorithm, and prepare for supporting alternative formats in the future. Removing the ability to make wrong choices is one of the lessons from SSL/TLS evolution, and from OpenVPN vs Wireguard design philosophy.
    – amon
    Nov 20, 2022 at 0:40
  • Yeah, i guess it's kinda custom. So, don't make it configurable. Gotcha. Then I guess that only leaves me with specifiying it explicitly in code?
    – yoad w
    Nov 20, 2022 at 5:13


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.