Starting with the release of FreeBSD pkg 2.8.0, SHA-256 will be phased out in favor of Blake2b for checksums (quantum resistance?)

6 min

暗号化セキュリティfreebsd雑記
language: ja bn en es hi pt ru zh-cn zh-tw

Hello, I am incompetent.
When the release of freebsd/pkg appeared on my GitHub timeline, the word Blake2b caught my eye.

https://github.com/freebsd/pkg/releases#release-2.8.0

  • Blake2b used everywhere possible for checksums; repositories use blake2 instead of sha256

It seems that Blake2b itself was included and released in GNU coreutils back in 2016.

What is Blake2b anyway?

I had only looked it up briefly before and recognized it as just another hash algorithm, so I checked it out a bit more.

Implementing Blake2 (Blake2b) in Rust #Security - Qiita

There are two types of Blake2: the standard version, Blake2b, and the reduced version, Blake2s. Blake2b is for 64-bit, and Blake2s is for 8-32 bit.

I see.

RFC:
RFC 7693 - The BLAKE2 Cryptographic Hash and Message Authentication Code (MAC)

It is also used for Argon2 password hashing. Is it becoming a modern design standard to replace current bcrypt implementations with Argon2 for password hashing, and current SHA-256 implementations with Blake2 for cryptographic hashing? Since I see quite a few recent implementations already using Argon2, I think it's possible. That said, md5sum is still used as a lightweight, high-speed hash and is convenient for simple integrity checks. In fact, even WebSocket is documented in the RFC to use SHA-1 for the WebSocket Handshake, but since there is no point in changing it for WS implementations, it remains as is.

The WebSocket handshake described in this document does not rely on the security properties of SHA-1 (such as collision resistance or resistance to second-preimage attacks) (as described in [RFC4270]).

RFC 6455 - The WebSocket Protocol

I was able to bounce this question off of ChatGPT (GPT 5.6).
In conclusion, while migrating to Argon2 is appropriate for modernization, for cryptographic hashes, it feels more like just having one more option available.
However, the fact that FreeBSD switched its pkg checksum usage was quite surprising, so perhaps it will become standard in the not-too-distant future?

Below is the question I asked GPT 5.6

Q. Is it becoming a modern design standard to replace current bcrypt implementations with Argon2 for password hashing, and current SHA-256 implementations with Blake2 for cryptographic hashing?

A. Yes, switching from bcrypt to Argon2id for password storage can certainly be calledQuite clear SHA-256 ───────→ BLAKE2 ↑ Not necessarily a replacement

is a close understanding.

Rather, in modern design,

Password
 └─ Argon2id
Cryptographic digest
 ├─ SHA-256
 ├─ SHA-3
 ├─ BLAKE2
 └─ BLAKE3
Message authentication
 ├─ HMAC-SHA256
 └─ keyed BLAKE2

it is modern to choose based on the use case as shown above.

Especially for new software you are designing yourself, if there are no constraints like protocol compatibility, I think it is good to consider it as follows:

Password hashing
→ Argon2id
General high-speed hashing
→ BLAKE2b / BLAKE3
Emphasis on compatibility with external standards/protocols
→ SHA-256
MAC
→ HMAC-SHA256
  or keyed BLAKE2

And what is important is BLAKE2 and BLAKE3. If your goal in a new design is to "use a faster hash than SHA-256," as of 2026, you should include BLAKE3 as a candidate, not just BLAKE2. BLAKE3 is extremely fast for parallelization, SIMD, and hashing large data.

However,

SHA-256 → BLAKE3

is not so much about "discarding SHA-256 for security reasons," but rather

a choice to gain benefits in performance and API design.

In other words, the two questions are not on the same level:

bcrypt → Argon2id

A direction to clearly modernize as a security design.

SHA-256 → BLAKE2/BLAKE3

A direction to choose based on performance and ease of use in new designs, rather than a mandatory security migration.

There is that difference.

If you expand this to "what would you choose if you were designing an API from scratch in 2026 that includes authentication, signatures, encryption, and file hashing," centering it around Argon2id / BLAKE3 / XChaCha20-Poly1305 / Ed25519 / X25519 would result in a very modern configuration.

Related Posts