Feature/sha256

[leo-mazzone]

TL;DR

SHA1 is not cryptographically secure, so I'm using SHA256 instead.

Rationale

The cryptographic requirements are not well defined at this stage of the project. However, we know that SHA1 has multiple vulnerabilities that would certainly preclude any cryptographic property we might want from hashes down the line.

SHA256 and SHA512 are both considered safe (at least publicly). While SHA256 has a more or less comparable length to SHA1 (160 vs 256 bits), unlike SHA512, which is more “future-proof”, i.e. if substantial computational advantages were made SHA512 would be more resistant. However, this is overkill at this stage.

In terms of collisions, SHA256 is safe enough. The probability of just two hashes accidentally colliding is approximately: 4.3*10-60 source, which is astronomically small.

There are details about how to use these message digest algorithms, for example the use of a salt, which is appropriate for password storage to avoid rainbow table attacks. They might also be appropriate in this case to reduce the probability of collision if many records are similar. However, this doesn’t increase the length of the hash, thus making it a problem for the production system, not for this benchmarking stage