On 2 March 2014 10:39, Mike Hearn <mike@plan99.net> wrote:

> I'm just repeating the rationale Gavin gave me for adding this to the spec
> last year when he was implementing it. Perhaps it only applied to some
> versions of PHP or something like that.
>

OK, but certainly now, SHA-2 is available as standard in PHP and has been
since PHP 5.1.2 as part of the hash() function. You can see from usage
stats that means practically every installation
http://w3techs.com/technologies/details/pl-php/5/all is PHP 5.2 and above.

Unless there is some other compelling reason, I would suggest removing
SHA-1 from the specification.

Drak