Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

SHA_Update is for the SHA-0 hash, and SHA1_Update is for the SHA-1 hash, so it's hardly completely illogical. The main issue here, is that people that don't know the difference between SHA-0 and SHA-1 should likely not be in charge of computing hashes by themselves. Crypto requires some expertise or it goes awry very fast, but then the educational system is producing plenty people with good crypto knowledge, it's hardly the niche it was only 20 years ago.

Also SHA-0 support is left out if OPENSSL_NO_SHA0 is defined, which must at last be the case in the FIPS version of the library, the one your want to use for regulation reasons in many cases...



The problem was that the names are too close to each other and was one typo away from mysterious bugs. The non-existence of documentation didn't help either.


If you go that way there is also MD2_Update, MD4_Update and MD5_Update, that are also one typo away of a bug you can't miss at all if you test anything.

Of the many many faults of the OpenSSL API you just didn't chose the right one.


Having been bitten by SHA1_Update with no expectation that SHA_Update would work as well. I'm sort of bitter about that.




Consider applying for YC's Summer 2026 batch! Applications are open till May 4

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: