Subject: [hybi] -09: SHA-1

From: Peter Saint-Andre <[email-masked]>
Date: Fri, 17 Jun 2011 11:35:41 -0600

In finishing my review of -09, I noticed the normative reference to
[FIPS.180-2.2002] for SHA-1. The WG might want to think about whether
the existing attacks against SHA-1 might raise concerns about a lack of
collision resistance for the Sec-WebSocket-Key header (see RFC 4270 and
RFC 6194 for details). It's probably worth saying something about this
in the security considerations.

My review is now complete. Thanks for listening!

Peter

-- 
Peter Saint-Andre
https://stpeter.im/