Skip to content

Note about hashing in collection lengths is a bit wrong. #284

@BartMassey

Description

@BartMassey

In the section Filling In Random Bits is written:

The other intersting thing to talk about is Hash itself. Do you see how we hash in len? That's actually really important! If collections don't hash in lengths, they can accidentally make themselves vulnerable to prefix collisions. For instance, what distinguishes ["he", "llo"] from ["hello"]? If no one is hashing lengths or some other "separator", nothing! Making it too easy for hash collisions to accidentally or maliciously happen can result in serious sadness, so just do it!

Unfortunately, the example is wrong: the two slices given hash to different values, since the length of each str is hashed into the collection. A better example is to use (): since unit contains no data it and slices of them are zero-sized types and all just produce the initial hash value.

This repo provides a demonstration of the issue.

I will provide a PR to fix in a moment.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions