{"action":"created","issue":{"url":"https://api.github.com/repos/nodejs/node/issues/3292","labels_url":"https://api.github.com/repos/nodejs/node/issues/3292/labels{/name}","comments_url":"https://api.github.com/repos/nodejs/node/issues/3292/comments","events_url":"https://api.github.com/repos/nodejs/node/issues/3292/events","html_url":"https://github.com/nodejs/node/pull/3292","id":110663271,"number":3292,"title":"Proposal: crypto: Make the digest parameter required for pbkdf2.","user":{"login":"tomgco","id":524382,"avatar_url":"https://avatars.githubusercontent.com/u/524382?v=3","gravatar_id":"","url":"https://api.github.com/users/tomgco","html_url":"https://github.com/tomgco","followers_url":"https://api.github.com/users/tomgco/followers","following_url":"https://api.github.com/users/tomgco/following{/other_user}","gists_url":"https://api.github.com/users/tomgco/gists{/gist_id}","starred_url":"https://api.github.com/users/tomgco/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/tomgco/subscriptions","organizations_url":"https://api.github.com/users/tomgco/orgs","repos_url":"https://api.github.com/users/tomgco/repos","events_url":"https://api.github.com/users/tomgco/events{/privacy}","received_events_url":"https://api.github.com/users/tomgco/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/nodejs/node/labels/crypto","name":"crypto","color":"009800"},{"url":"https://api.github.com/repos/nodejs/node/labels/semver-major","name":"semver-major","color":"fbca04"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":2,"created_at":"2015-10-09T13:52:49Z","updated_at":"2015-10-09T14:45:20Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/nodejs/node/pulls/3292","html_url":"https://github.com/nodejs/node/pull/3292","diff_url":"https://github.com/nodejs/node/pull/3292.diff","patch_url":"https://github.com/nodejs/node/pull/3292.patch"},"body":"This change will remove the default behaviour of defaulting to SHA1\r\nas its digest function, instead this will break backwards compatibility\r\nand force implementers to choose a secure digest that is suited for them\r\nat that time.\r\n\r\nAt this moment of time SHA1 is fine to be used as an HMAC, but this statement\r\nwill eventually not be true, as is the nature of cryptography. Instead of changing the default\r\nhash algorithm when we deem one to be not secure (and thus break backwards\r\ncompatibility at each change in the future), implementing this fix now (v5?) will remove any future\r\nbreakages as it pushes the choice onto the consumer of this api.\r\n\r\nI would like to hear your thoughts on this, I understand that this sub-module is at the stability index of 2: stable, however I still think that this should be changed now, instead of waiting till it *has* to be changed.\r\n\r\nThanks."},"comment":{"url":"https://api.github.com/repos/nodejs/node/issues/comments/146892469","html_url":"https://github.com/nodejs/node/pull/3292#issuecomment-146892469","issue_url":"https://api.github.com/repos/nodejs/node/issues/3292","id":146892469,"user":{"login":"tomgco","id":524382,"avatar_url":"https://avatars.githubusercontent.com/u/524382?v=3","gravatar_id":"","url":"https://api.github.com/users/tomgco","html_url":"https://github.com/tomgco","followers_url":"https://api.github.com/users/tomgco/followers","following_url":"https://api.github.com/users/tomgco/following{/other_user}","gists_url":"https://api.github.com/users/tomgco/gists{/gist_id}","starred_url":"https://api.github.com/users/tomgco/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/tomgco/subscriptions","organizations_url":"https://api.github.com/users/tomgco/orgs","repos_url":"https://api.github.com/users/tomgco/repos","events_url":"https://api.github.com/users/tomgco/events{/privacy}","received_events_url":"https://api.github.com/users/tomgco/received_events","type":"User","site_admin":false},"created_at":"2015-10-09T14:45:20Z","updated_at":"2015-10-09T14:45:20Z","body":"> Deprecating the 'default digest' overload might be reasonable (discussion needed) but it has to go through a deprecation cycle first to give people time to upgrade, i.e., v5 prints a warning, v6 throws.\r\n\r\nShall I create a new PR with the deprecation notice and link it to this issue? "}}