Hacker News Reader

Comment by jodrellblank | Hacker News Reader

Who named it "Secure Hash Algorithm" :|

Now the name will be annoyingly and misleadingly wrong forever, in a way that was totally predictable.

That was the name of the standard, for which they had to pick a "Secure Hash Algorithm". And it's normal to have to update standards over time, regardless of the name. Which name would you have suggested for a standard defining a secure hash function? Usually it's better to not use fantasy names for standards, and "A Hash Function That Is Secure Now But Maybe Not Anymore In 10 Years" it's a bit too verbose in my opinion.

The same concept applies to telescopes. Every year a "Ridiculously Huge Telescope" gets announced. If I named them I'd start small: "Decently Sized Telescope"; "Mildly Safe Hashing Algorithm".

Huge Telescope 1. Huge Telescope 2. Huge Telescope 3.

If we do the same thing as the hash names, I think it's fine. "SHA-1", specifically with the "1", doesn't cause problems.

Change "Secure" for "FIPS" and you have a decent name. FHA-1 -- FIPS hash algorithm, version 1.

Yes, this could have worked. But unfortunately it's too late now: changing the name of the standard now would create confusion as well.

Exactly. Look at video codecs. H.264 is named AVC - Advanced Video Codec. now we have VP9, HEVC(H.265), AV1 and VVC(H.266) being better.

Or AAC - Advanced Audio Codec. Fast forward a few years, Opus came out and you can reduce the bitrate by another 30-50% with similar performance

Cryptographers have a long history of doing this. Many of them broken. DES and WEP are two that immediately spring to mind.

Well, in that case, we should remove "Secure" from any protocol name like HTTPS, FTPS, SSH and pretty much everything, because by definition, whatever is secure at a given time probably wont be anymore 10years later.

No because those S's don't mandate any particular algorithm; HTTPS has changed from SSL to TLS, and SSH often throws up mismatched cipher or version errors when connecting to older servers, so they could still be secure 10 years later.

I would however be fine with removing "unlimited" from the name of services which are limited, 'Simple' from protocols which don't need subjective comments about their complexity, 'Ultimate' and 'Supreme' from the names of things which are neither the last nor best, etc.

Well, the safest part of any seatbelt is the part that goes over the chest, not the seat :-)

Standards evolve, and SHA has grown new generations to replace ones that have become insecure. See also "Secure Sockets Layer."

Fortunately it's still true for Fast Fourier Transform. Would be fun to break that one.

Reply on news.ycombinator.com