Re:Multihash – self-describing hashes
by _prometheus on Sunday February 26, 2017 @03:05PM
(#13739481)
That's right. It's really important to make sure there is restrictions on what hashes to use if your system is receiving hashes and only checking them for self-consistency.
Particularly relevant is "Crypto Extensibility" (formats and protocols to be able to extend a protocol), vs "Crypto Agility" (the use of Crypto Extensibility to use simultaneously a large variety of algorithms, with the key feature that one can be downgraded to an old/possibly broken hash.
Particularly relevant is "Crypto Extensibility" (formats and protocols to be able to extend a protocol), vs "Crypto Agility" (the use of Crypto Extensibility to use simultaneously a large variety of algorithms, with the key feature that one can be downgraded to an old/possibly broken hash.
AGL describes it well here: https://www.imperialviolet.org/2016/05/16/agility.html
---
I've filed https://github.com/multiformats/multihash/issues/70 to track this.