{"action":"created","issue":{"url":"https://api.github.com/repos/httpwg/http-extensions/issues/228","repository_url":"https://api.github.com/repos/httpwg/http-extensions","labels_url":"https://api.github.com/repos/httpwg/http-extensions/issues/228/labels{/name}","comments_url":"https://api.github.com/repos/httpwg/http-extensions/issues/228/comments","events_url":"https://api.github.com/repos/httpwg/http-extensions/issues/228/events","html_url":"https://github.com/httpwg/http-extensions/issues/228","id":172244983,"number":228,"title":"Digest algorithm","user":{"login":"mnot","id":74384,"avatar_url":"https://avatars.githubusercontent.com/u/74384?v=3","gravatar_id":"","url":"https://api.github.com/users/mnot","html_url":"https://github.com/mnot","followers_url":"https://api.github.com/users/mnot/followers","following_url":"https://api.github.com/users/mnot/following{/other_user}","gists_url":"https://api.github.com/users/mnot/gists{/gist_id}","starred_url":"https://api.github.com/users/mnot/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mnot/subscriptions","organizations_url":"https://api.github.com/users/mnot/orgs","repos_url":"https://api.github.com/users/mnot/repos","events_url":"https://api.github.com/users/mnot/events{/privacy}","received_events_url":"https://api.github.com/users/mnot/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/httpwg/http-extensions/labels/cache-digest","name":"cache-digest","color":"fbca04"},{"url":"https://api.github.com/repos/httpwg/http-extensions/labels/design","name":"design","color":"02d7e1"}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":7,"created_at":"2016-08-20T01:01:13Z","updated_at":"2016-09-28T07:06:18Z","closed_at":null,"body":"A few people have noted that SHA-1 is probably overkill."},"comment":{"url":"https://api.github.com/repos/httpwg/http-extensions/issues/comments/250088622","html_url":"https://github.com/httpwg/http-extensions/issues/228#issuecomment-250088622","issue_url":"https://api.github.com/repos/httpwg/http-extensions/issues/228","id":250088622,"user":{"login":"kazuho","id":41567,"avatar_url":"https://avatars.githubusercontent.com/u/41567?v=3","gravatar_id":"","url":"https://api.github.com/users/kazuho","html_url":"https://github.com/kazuho","followers_url":"https://api.github.com/users/kazuho/followers","following_url":"https://api.github.com/users/kazuho/following{/other_user}","gists_url":"https://api.github.com/users/kazuho/gists{/gist_id}","starred_url":"https://api.github.com/users/kazuho/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/kazuho/subscriptions","organizations_url":"https://api.github.com/users/kazuho/orgs","repos_url":"https://api.github.com/users/kazuho/repos","events_url":"https://api.github.com/users/kazuho/events{/privacy}","received_events_url":"https://api.github.com/users/kazuho/received_events","type":"User","site_admin":false},"created_at":"2016-09-28T07:06:18Z","updated_at":"2016-09-28T07:06:18Z","body":"My tendency goes to 4.\r\n\r\nIf we are to actually choose a simpler algorithm than SHA, I think the choice should better be made based on the popularity and the quality of the hash function.\r\n\r\nAnd for that respect, SipHash 2-4 might be a good candidate. It is known to be fairly fast, and is used as a basis by many hash table implementations (thanks to its resistance to collision).\r\n\r\nI am not sure how collisions can be used to attack Cache Digests, but it might still be a good idea to have resistance considering the fact that an attacker can insert a digest (by controlling the victim's browser to access a specific resource on the target's website (by using IMG links, etc.)."}}
{"actor":{"display_login":"kazuho"}}