name_generator uses a fixed, insecure hash algorithm (SHA1)

[boostorg]

name_generator uses a fixed, insecure hash algorithm (SHA1)

[Lastique]

1. The UUID generation from name is described in RFC4122, which specifies MD5 or SHA1. I'm not sure the current implementation fully follows the spec, but I think it should be used as the reference and the default.
2. If you still want to make the hash algorithm configurable, I would prefer an implementation without virtual functions. They are not required if you follow the templated approach - just define the concept of the hashing function and use the template argument accordingly.
3. In order to not break backward compatibility I would suggest implementing the configurable version of name_generator under a different name, like basic_name_generator or something. name_generator can be made a typedef to this new implementation.

[jeking3]

@Lastique Thank you for your comments.

On item 1, hashes, given SHA1 has recently been compromised, it would make sense to start planning for a replacement. This actually got me thinking as to whether a new IETF document with all the published errata and the addition of another hashing algorithm (or two?) would be warranted.

On item 2, I think it would be an interesting exercise to do what you suggest, and add MD5 as an option. Obviously there will be little to no use of it, but it will complete the implementation with respect to the RFC. I like your strategy in item 3 as well.

[mclow]

I can ask an IETF co-worker of mine about future work on RFC4122 (or a followup RFC).

As a design comment, I agree with @Lastique that having a "hash function" as a template argument rather than using inheritance is a better way to go. [ See the unordered containers for examples. ]

[jeking3]

@mclow much appreciated - thank you for taking the time do check on that.

[jeking3]

@mclow were you able to make any progress on a RFC4122 follow-up discussion?

[mclow]

I believe that the IETF people are discussing it - but no resolution AFAIK yet.

[jeking3]

@mclow I reached out by email to the original authors in RFC 4122 however paulle and rsalz emails bounced.

[jeking3]

@mclow my emails to folks on the RFC 4122 bounced. This issue has stalled. Do you have any more contacts or should I think about starting an update of the RFC?