Subject: [hybi] Why was SHA-1 chosen as hashing method?

From: Bruce Atherton <[email-masked]>
Date: Wed, 06 Apr 2011 10:40:26 -0700

/Here is the question and original answer from the FAQ:/

*Why is SHA-1 necessary? How about simple math like multiplication or CRC*

SHA-1 was deemed a reasonable approach to getting a hash value that is 
very unlikely to collide with another. Implementations are widely 
available in many languages, and since the calculation is done only at 
the beginning of the connection, the cost was seen as minimal enough not 
to cause any concerns especially compared to other elements of setting 
up a connection.

See:
     Dave's comment 
[http://www.ietf.org/mail-archive/web/hybi/current/msg06598.html]
         Common, verifiable and very unlikely to clash

/And here is the debate that was added:/

-- Follow-up question to this answer: is the plus operator uncommon? 
Unverifiable? Likely to clash?

== Are you really arguing that for a simple web-socket implementation, 
the developer will HAVE to include a library implementing bignum types 
and SHA1 algorithm, instead of using simple math, such as addition ("+" 
operator), such as available in any computer language ? What languages 
does the "implementations are widely available in many languages" 
argument refer to? Is requirement of loading a crypto library in a 
websocket server just for the handshake considered "minimal cost"?

== What "clash" is Dave talking about in the comment linked? Given 
number A from client and number B from server, check that the 
C=function(A,B) calculated on server matches with C=function(A,B) 
calculated on client. The function can be addition ("+" C operator), 
mod-multiplication ("*","%" C operators) or any other simple function. 
There's no requirement for hash-style one way functions. Why add 
complexity?