On 2 March 2014 10:39, Mike Hearn <mike@plan99.net> wrote:

I'm just repeating the rationale Gavin gave me for adding this to the spec last year when he was implementing it. Perhaps it only applied to some versions of PHP or something like that.

OK, but certainly now, SHA-2 is available as standard in PHP and has been since PHP 5.1.2 as part of the hash() function. You can see from usage stats that means practically every installation http://w3techs.com/technologies/details/pl-php/5/all is PHP 5.2 and above.

Unless there is some other compelling reason, I would suggest removing SHA-1 from the specification.

Drak