Need clarification on recommended Authentication Algorithm

[devd_25]

Quoting from the docs for Define IPSec Crypto Profiles, it says 

For the authentication algorithm, use SHA-256 or higher (SHA-384 or higher preferred for long-lived transactions). Do not use SHA-512, SHA-1, or MD5. 

Whereas, going from most to least secure, it recommends the below order 

Authentication—sha512, sha384, sha256, sha1, md5.

 Can someone please help clarify what is right or wrong ? Thanks!

[BatD]

@devd_25 The second line shows what is supported on the firewall and the first what is recommended to use. 

[Sai_Tumuluri · Accepted solution]

@devd_25  Anything from SHA256 and above is secure. To use SHA-512 or SHA-384, you need to have compatible servers and are not widely used. Other reasons include processing time.  Following public links can add some more info

https://security.stackexchange.com/questions/165559/why-would-i-choose-sha-256-over-sha-512-for-a-ss...

https://automationrhapsody.com/md5-sha-1-sha-256-sha-512-speed-performance/

[devd_25]

Hi @BatD , thats right. However, if you notice, first it says 

Do not use SHA-512, SHA-1, or MD5. 

 Then, it recommends in the order of most to least secure starting with SHA-512, implying that SHA-512 is most secure. Hence, needed clarification on that. Might be a documentation error.

[BatD]

@devd_25 This is correct, SHA-512 is indeed the most secure, but not recommended for reasons mentioned by @Sai_Tumuluri - processing resources, comapability, etc. 

[Sai_Tumuluri]

@devd_25 Please mark if you are satisfied with the solution. This closes the discussion and helps others to fastly identify the solutions