-
Notifications
You must be signed in to change notification settings - Fork 295
Description
In the section Filling In Random Bits is written:
The other intersting thing to talk about is Hash itself. Do you see how we hash in
len
? That's actually really important! If collections don't hash in lengths, they can accidentally make themselves vulnerable to prefix collisions. For instance, what distinguishes["he", "llo"]
from["hello"]
? If no one is hashing lengths or some other "separator", nothing! Making it too easy for hash collisions to accidentally or maliciously happen can result in serious sadness, so just do it!
Unfortunately, the example is wrong: the two slices given hash to different values, since the length of each str
is hashed into the collection. A better example is to use ()
: since unit contains no data it and slices of them are zero-sized types and all just produce the initial hash value.
This repo provides a demonstration of the issue.
I will provide a PR to fix in a moment.