News for hackers. Stuff that matters.
Re:How to Check 2 SQL Tables Are the Same by Someone on Friday July 28, 2023 @10:32AM (#36907342)
If you hash each row in isolation and XOR the hashes of all rows, you don’t need the ordering. I also think XOR-ing loses you ‘resolving power’ for this problem, compared to hashing the hashes or hashing everything in one go.
Re:How to Check 2 SQL Tables Are the Same by photon_lines on Friday July 28, 2023 @02:23PM (#36911058)
Ahhh nice - yup that's one solution and really elegant as well. Great suggestion :)
Re:How to Check 2 SQL Tables Are the Same by sibrahim on Friday July 28, 2023 @04:20PM (#36912745)
XOR is not a great choice here. Consider that 2 copies of a row give the same result as 0 (or 4, 6, etc). And even without multiple copies of rows, you can force any hash you'd like by observing what happens when you insert more random rows and finding a subcollection that flips exactly the bits you want.

What you probably want to look at is homomorphic hashing. This is usually implemented by hashing each row to an element of an appropriate abelian group and then using the group operation to combine them.

With suitable choice of group, this hash can have cryptographic strength. Some interesting choices here are lattices (LtHash), elliptic curves (ECMH), multiplicative groups (MuHash).

Re:How to Check 2 SQL Tables Are the Same by Someone on Friday July 28, 2023 @05:18PM (#36913476)
> XOR is not a great choice here. Consider that 2 copies of a row give the same result as 0 (or 4, 6, etc).

That indeed is a major flaw. You have to use another commutative operation that doesn’t destroy entropy. Addition seems a good choice to me.

> And even without multiple copies of rows, you can force any hash you'd like

I don’t see how that matters for this problem.

Re:How to Check 2 SQL Tables Are the Same by sibrahim on Friday July 28, 2023 @05:39PM (#36913725)
It depends on whether you are doing something security critical with the result.

Maybe you have a trusted table hash but only a user-supplied version of the table. Before you use that data for security sensitive queries, you should verify it hasn't been modified.

Basically, if you ever have to contend with a malicious adversary, things are more interesting as usual. If not, addition is perfectly fine.