5 ms·
The section about signature hashes could use some improvement. Cryptographic hashes have multiple use cases. The main one that comes to mind is basically just s
by zeroimpl 4y ago
The section about signature hashes could use some improvement. Cryptographic hashes have multiple use cases. The main one that comes to mind is basically just secure checksum/integrity hashes where you want to guarantee nobody could force a collision. For this case, all the scary warnings about "don't use these algorithms directly" makes no sense.
- ciprian_craciun 4y agoThe section on "signature hashes" was kept short on purpose because anything that relates to real cryptography or security use-cases should require at least using a high-quality (as in audited) high-level library (like `libsodium`), and / or doing your real in-depth research, not reading a few paragraphs on a random person's blog. :) For example even in the case you've described "where you want to guarantee nobody could force a collision" my suggestion is to use a keyed algorithm (like Blake3) or a HMAC and choose a different key (if not for each "instance" algorithmically tied to it, at least for each "deployment"). It doesn't solve the brute force, but it might save you from other mistakes related to how you use those hashes (like for example when the attacker might swap or replace two payloads with their hashes).