Redundant requirement about secure hash functions

[randomstuff]

6.6.1 and 6.6.3 look very much the same to me:

#	Description	L1	L2	L3	CWE
6.6.1	[ADDED] Verify that only approved hash functions are used for general cryptographic use cases, including digital signatures, HMAC, KDF, and random bit generation.		✓	✓
6.6.3	[ADDED, SPLIT FROM 6.2.5] Verify that cryptographic systems avoid the use of disallowed hash functions, such as MD5, SHA-1, or any other insecure hash functions, for any cryptographic purpose.	✓	✓	✓

A disapproved hash function cannot be approved right? So if we check that they are approved, we also check they are not disallowed?

By the way should be say "cryptographic hash functions" everywhere. For example, SipHash might very well be an approved hash function but is not an approved cryptographic hash functions. (Sure, we are in the cryptography chapter but still …).

[jmanico]

Based on your comment and observation, it looks like 6.6.3 should go away.

[elarlang]

Yes, seems like those are duplicates.

6.6.1 can not be just ADDED, as there was something on the topic in v4.0.3.

I think the modification tag needs to point to v4.0.3-6.2.3.

• https://asvs.dev/v4.0.3/0x14-V6-Cryptography/#v62-algorithms

The modification tag for current 6.6.3 must be reviewed as well:

• https://asvs.dev/mapping_v5.0.be.html#v5.0.be-6.6.3

[tghosth]

@elarlang do you think this handles it:
#2536