Replace MD5 and SHA1 #4542
Replace MD5 and SHA1 #4542
Conversation
| // Set the hash algoritm to 'SHA1'. | ||
| myAssemblyName->HashAlgorithm = AssemblyHashAlgorithm::SHA1; | ||
| // Set the hash algorithm to 'SHA256'. | ||
| myAssemblyName->HashAlgorithm = AssemblyHashAlgorithm::SHA256; |
There was a problem hiding this comment.
I don't know that SHA256 actually works here.
| // Set the hash algoritm to 'SHA1'. | ||
| myAssemblyName.HashAlgorithm = AssemblyHashAlgorithm.SHA1; | ||
| // Set the hash algorithm to 'SHA256'. | ||
| myAssemblyName.HashAlgorithm = AssemblyHashAlgorithm.SHA256; |
There was a problem hiding this comment.
Another triplet of AssemblyName.HashAlgorithm being updated. It might work, I just know that some parts of this system are effectively limited to MD5 and SHA1... and I don't know if this is one of them or not. (We could, of course, update them, and if we get feedback it doesn't work, then change them back)
| Byte[] updHash = Sha1.ComputeHash(Encoding.UTF8.GetBytes("username" + "password" + "domain")); | ||
| SHA256 Sha256 = SHA256.Create(); | ||
| Byte[] updHash = Sha256.ComputeHash(Encoding.UTF8.GetBytes("username" + "password" + "domain")); | ||
| String secureGroupName = Encoding.Default.GetString(updHash); |
There was a problem hiding this comment.
Not really the problem at hand, but: I don't know that this is going to do anything useful. The hash may contain a zero-byte, which will make the string effectively terminate early.
It's also weird that the "secure group name" is a hash of static data. Might want to get networking to review this sample to see what it's supposed to be doing.
There was a problem hiding this comment.
This is for HttpWebRequest, which has an Important alert box warning that "We don't recommend that you use HttpWebRequest for new development. Instead, use the System.Net.Http.HttpClient class." The example is for ConnectionGroupName property. It may not be worth someone's time to investigate and I should just revert the changes on these files(?)
There was a problem hiding this comment.
Yeah, reverting the edit and changing it to the "don't use SHA1" comment may be the short-term best.
eiriktsarpalis
added
area-System.Runtime
area-System.Security
Fixes dotnet/docs#10198