Migrate to sha384/512 on SRI hash calculation

[PeterDaveHello]

Issues:

1. We'll need a powerful and individual platform to focus on re-calcuating all the hashes over all the 950k js & css files?
2. Should the origin sha256 hashes be preserved? Is the answer is yes, how do we deal with it? (How to display on the UI? How to save both sha256 and sha384 hashes?)
3. How urgent we need it?
4. How's the impact on performance on both hash calculation and website hosting? Especially the calculation time and memory consumption part.

---

Want to back this issue? Post a bounty on it! We accept bounties via Bountysource.

[MattIPv4]

Bringing @drewfreyling's comment from #13384:

I'm in favour of just offering up the SHA-512 values since it is:

• Less bytes in the browser
• All browsers (currently) must support 256, 384 and 512 (https://w3c.github.io/webappsec-subresource-integrity/#hash-functions)

If at some point we get fragmented browser support than I think providing multiple hashes makes sense.

[myshov]

@PeterDaveHello @MattIPv4
Hello guys
I think you should to prioritize this issue because SHA-256 and SHA-512 are susceptible to length extension attacks. I suggest to use SHA-384 by default because it has no this flaw https://blog.skullsecurity.org/2012/everything-you-need-to-know-about-hash-length-extension-attacks

[MattIPv4]

cc @zackbloom @xtuc

[MattIPv4]

We should keep this open as we are still looking at implementing this.

[PeterDaveHello]

Feel free to open a new issue for it(or maybe just use the opened pull request for discussion), as I was removed from the organization without any discussion and respect, just like some other members(I know it's not by you and you're not the one who's in charge for that), I'm now closing ancient issues I'm not working on so that I don't need to receive unnecessary notifications, thanks.

[ExE-Boss]

Did you know that you can simply unsubscribe from issues you no longer wish to receive notifications for?

It’s what that button in the sidebar is there for.

---

https://help.github.com/en/github/receiving-notifications-about-activity-on-github/subscribing-to-and-unsubscribing-from-notifications#managing-your-notification-settings-for-an-issue-or-pull-request

[MattIPv4]

Noting this down: the current SRI generation happens in https://github.com/cdnjs/tools/blob/master/packages/packages.go#L86 & https://github.com/cdnjs/tools/blob/master/openssl/sri.go

[klausenbusk]

I have opened a PR: cdnjs/tools#46

[xtuc]

Thanks for your PR @klausenbusk! It already lgtm but I want to make sure which SHA-384/512 we should be using