Specify hash function naming

[fulldecent]

The current specification shows the example:

<script src="https://example.com/example-framework.js"
        integrity="sha384-Li9vy3DqF8tnTXuiaAJuML3ky+er10rcgNR/VqsVpcw+ThHmYcwiB1pbOxEbzJr7"
        crossorigin="anonymous"></script>

But elsewhere it refers to the same hash function as "SHA-384". Please specify which spelling is normative.

[jonathanKingston]

I think this is somewhat valid however the spec does make some differences in their usages.

https://www.w3.org/TR/CSP2/#source-list-valid-hashes explains the mapping of SHA-384 to the sha384 hash-algo prefix.

However there is one other usage which is perhaps confusing:

which would allow the user agent to accept two different content payloads, one of which matches the first SHA384 hash value and the other matches the second SHA384 hash value.

I suspect these SHA384 should have actually been "sha384" given that it's describing the prefix and not the algo.

I think there are two points that seem valid here:

• Link better to the parsing algorithm of CSP or separate it out so both specifications can use it.
• Fix the sentence I mentioned above.

[jonathanKingston]

Ah I see there is #84 (comment) which covers most of my comment. That sentence is still an issue though.

[devd]

Can I convince you to send a PR? :)

…

On Fri, Jan 3, 2020, 12:58 PM Jonathan Kingston ***@***.***> wrote: Ah I see there is #84 (comment) <#84 (comment)> which covers most of my comment. That sentence is still an issue though. — You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub <#89?email_source=notifications&email_token=AABBOGKVPDHIDLUM5TGIBK3Q36RIPA5CNFSM4KCRWQF2YY3PNVWWK3TUL52HS4DFVREXG43VMVBW63LNMVXHJKTDN5WW2ZLOORPWSZGOEICCEQY#issuecomment-570696259>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AABBOGPUUA4KXXHPTEGKDX3Q36RIPANCNFSM4KCRWQFQ> .

[jonathanKingston]

After much deliberation I think the second sentence actually is clearer given it's non-normative anyway:

[devd]

fixed per above.