HMAC-SHA1 vs HMAC-SHA256 I have three questions:


Would you use HMAC-SHA1 or HMAC-SHA256 for message authentication?
How much HMAC-SHA256 is slower than HMAC-SHA1?
Are the security improvements of SHA256 (over SHA1) enough to justify its usage?
Would you use HMAC-SHA1 or HMAC-SHA256 for message authentication?


Yes.

That is a semi-serious answer; both are very good choices, assuming, of course, that a Message Authentication Code is the appropriate solution (that is, both sides share a secret key), and you don't need extreme speed.


  How much HMAC-SHA256 is slower than HMAC-SHA1?


Those sorts of crypto performance questions are quite platform specific, and so it's hard to answer definitively.  In my experience, I've seen SHA-1 (and hence HMAC-SHA-1) be about 30% faster than SHA-256; Your Mileage May Vary, of course.

Of course, the obvious comeback is "how much is this performance delta important to you?".  That rather depends on how fast you're adding/checking integrity tags.


  Are the security improvements of SHA256 (over SHA1) enough to justify its usage?


To the best of our knowledge, there is essentially no security difference between HMAC-SHA256 and HMAC-SHA1; with a sufficiently long key, both are impervious to brute force, and with a reasonably long tag, both will catch any forged messages with the expected probability.  There is a known weakness to SHA1 that allows someone to compute a collision in less time than expected; there is no known way to apply that to HMAC-SHA1, and so there are no known methods of attack (other than, as I mentioned just now, brute force, and guessing the tags randomly).