There are ciphersuites with SHA256, and SHA384. In the following TLS ciphersuite, the SHA types is not specified. Does this always refer to SHA1 (there is SHA0 as well) so which one of them?
Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It only takes a minute to sign up.Sign up to join this community
Does this always refer to SHA1
Yes, within TLS ciphersuites, an unadorned "SHA" means SHA-1. The oldest of these ciphersuite names predate any of the SHA2 hashes (and so if they use them, they'll explicitly list the size, e.g. SHA256), and SHA-0 is never used.
From the Glossary (appendix B) in RFC 5248: TLS 1.2:
The Secure Hash Algorithm [SHS] is defined in FIPS PUB 180-2. It produces a 20-byte output. Note that all references to SHA (without a numerical suffix) actually use the modified SHA-1 algorithm