Re:"YOLO" is not a valid hash construction
by hamandcheese on Saturday August 24, 2024 @07:31PM
(#41342803)
Does that mean the random suffix is effectively a secret? Otherwise an attacker could construct inputs with the separator, achieving the same thing as a simple separator, right?
[ Parent
| on HN ]
Re:"YOLO" is not a valid hash construction
by oconnor663 on Saturday August 24, 2024 @07:35PM
(#41342834)
It's not a random suffix, but a length suffix. So for example putting "hello" and "world!" together looks like "hello" | 5 | "world!" | 6. Concretely, you probably represent 5 and 6 as eight little-endian bytes, i.e. `n.to_bytes(8, 'little')` in Python. If you want to stop attackers from guessing/constructing hashes, you need to get a secret key involved, which is what the "YoloMAC" section of the post is about.