News for hackers. Stuff that matters.
Re:What is the point of a public key fingerprint? by atoav on Sunday December 17, 2023 @04:40AM (#38671637)
On way to deal with this is to hash it again. For demonstration purposes I used CRC8, but a longer hash is probably less prone against further collisions):

    307e0e71a409d2bf67e76c676d81bd0ff87ee228cd8f991714589d0564e6ea9a = 0x7B

    307e0e71a4098e7fb7d72c86cd041a006181c6d8e29882b581d69d0564e6ea9a = 0xFC
Re:What is the point of a public key fingerprint? by shzhdbi09gv8ioi on Sunday December 17, 2023 @07:13AM (#38672334)
Um, not sure what you aim to solve here.

You are effectively increasing collision risk by an arbitrary amount by running hash output as input to a crc algorithm.

Kids, don't roll your own security.

Re:What is the point of a public key fingerprint? by skinkestek on Sunday December 17, 2023 @07:42AM (#38672485)
I think you misunderstood:

This is if you compare two hashes and they look really similar but you want to be really sure.

Of course a real equality check is better but visual check of original hash + this is better than visual check alone.

Re:What is the point of a public key fingerprint? by shzhdbi09gv8ioi on Sunday December 17, 2023 @11:16AM (#38673818)
Ah, thanks. Yes, I did not understand this properly.
Re:What is the point of a public key fingerprint? by ijustlovemath on Sunday December 17, 2023 @10:18AM (#38673402)
A similar technique is employed by git to get past SHA-1 collision risk, so I wouldn't say it's entirely without merit.
Re:What is the point of a public key fingerprint? by atoav on Sunday December 17, 2023 @05:16PM (#38677023)
Before: two hashes that might pass a manual check

After: four hashes that don't pass a manual check

The short ones are there so you can easily spot the collision in the long one, even if the start and the end are the same. If you read just the short ones your criticism applies, but that was not the idea. You read the long one first, then the short one. This is a logical AND not a logical OR, thus it gets harder to make both collide at once (because there are less similar looking values for the first one that produce the same values in the second one + your attacker might not know which one you are using).

Maybe if you read my comment, you will also realize I pointed out that CRC8 is the wrong choice for this, but I was on my phone and this was the hash calculator I found first.