diff --git a/specifications/xpath-functions-40/src/function-catalog.xml b/specifications/xpath-functions-40/src/function-catalog.xml
index 9ffcff85d..2f3ec5e66 100644
--- a/specifications/xpath-functions-40/src/function-catalog.xml
+++ b/specifications/xpath-functions-40/src/function-catalog.xml
@@ -5369,15 +5369,17 @@ return normalize-unicode(concat($v1, $v2))
the value through fn:upper-case(fn:normalize-space())
.
Conforming implementations
MD5
: the MD5 Message-Digest algorithm defined by
SHA-1
: the SHA-1
algorithm, defined by BLAKE3
: the BLAKE3
algorithm defined by
CRC-32
: the CRC-32
algorithm, defined by
SHA-1
: the SHA-1
algorithm, defined by
SHA-256
: the SHA-256
algorithm, defined by
CRC-32
: the CRC-32
algorithm, defined by
Conforming implementations
It is common for secure algorithms to be cryptographically broken, as has happened to
- the algorithms MD5
and SHA-1
. Developers are responsible for
+ the algorithms MD5
, SHA-1
, and SHA-256
.
+ And the CRC-32
algorithm is not intended for cryptographic purposes.
+ Developers are responsible for
ensuring that the algorithm chosen meets any expected security protocols, if
relevant.
The BLAKE3
algorithm is included in the list of hashing algorithms
+ because at the time of writing it appears to be a promising candidate as a secure and fast algorithm
+ that shows signs of gaining widespread support.
+ However, this is a fast moving field and the community group recognizes that this decision might eventually not stand the test of time.
+ As the technology evolves in the future, implementations are free to drop support for this algorithm and substitute another
+ that appears to better meet requirements.
+
Additional security practices, such as salting, may be applied as a preprocessing step,
or fn:hash()
can be incorporated into more complex functions.
In most cases, the xs:hexBinary
output of the function will be sought in
@@ -5424,6 +5435,19 @@ return normalize-unicode(concat($v1, $v2))