Cryptographic Right Answers

Then I have two basic questions (for either you and tptacek):

1) Given I just need to hash the contents of a file for content-addressed data (like in git), it seemed like sha2-256 would be sufficient. However, it seemed like on 64-bit machines, sha2-512 is faster, and I can just lop off the first 256 bits. Is that correct? And in what cases would you use sha3-256/sha3-512?

2) Given I need to build an API that authenticates through client tokens, I was thinking of using JWT (json web tokens) with HMAC256, and a payload with a randomly generated token for the at_hash claim, and send it over TLS. Do I need to include a nonce in the payload? If not, it's the same JWT on every client request. If so, how would you recommend generating a nonce?

In the article, under symmetric signatures, you talk about not doing anything complicated with the data you feed into the HMAC. But I'm not sure what the simple construction of this data is. Is it where you say "just concatenate the key and data and hash them and be secure"?

	    			Percival 	Ptacek			Latacora
				2009		2015			2018

	Online backups		tarsnap		tarsnap			tarsnap

	Symmetric key length	256-bit		256-bit			256 bit

	Symmetric “Signatures”	HMAC		HMAC			HMAC

	Random IDs		256-bit		256-bit			256-bit
				
	Hashing algorithm	SHA256 (SHA-2)	SHA-2			SHA-2


	Password handling	scrypt		scrypt			scrypt	
				PBKDF2		bcrypt			argon2
						PBKDF2			bcrypt
									PBKDF2

	Website security	OpenSSL		OpenSSL			AWS ALB/ELB
						BoringSSL		OpenSSL
						AWS ELBs		LetsEncrypt

	Client-server		OpenSSL		OpenSSL			AWS ALB/ELB
	app security				BoringSSL		OpenSSL
						AWS ELBs		LetsEncrypt


	Asymmetric encryption	[1]		NaCl/libsodium 		NaCl/libsodium
		

	Asymmetric signatures	[2]		NaCl			NaCl
						Ed25519			Ed25519
						RFC6979

	Diffie-Hellman		[3]		DH-2048			Nothing
						NaCl			Curve25519


	Encrypting Data:	AES-CTR HMAC	NaCl/libsodium default	KMS
						ChaCha20-Poly1305	XSalsa20+Poly1305
						AES-GCM

[2] RSASSA-PSS with SHA25 or MGF1+SHA256 in tricolor systemic silicate orientation

[3] 2048-bit Group #14 with a generator or 2

> If you could use KMS but encrypting is just a fun weekend project and you might be able to save some money by minimizing your KMS usage, use KMS. If you’re just encrypting secrets like API tokens for your application at startup, use SSM Parameter Store, which is KMS. You don’t have to understand how KMS works.

Paragraphs like this come across quite condescending, and the tone might have more to do with the lack of adoption of the ideas herein than the content does.

Security Professionals seem to have an unfortunate habit of talking down to everybody else.