News for hackers. Stuff that matters.

A comment on "YOLO" is not a valid hash construction. Parent comment

Re:"YOLO" is not a valid hash construction by thequux on Sunday August 25, 2024 @06:51AM (#41346306)
It must be a length prefix or you're still vulnerable to length extension attacks. Suppose you had encoded "foo3"; the attacker could easily extend that to "foo3bar7".
[ Parent | on HN ]
Re:"YOLO" is not a valid hash construction by justincormack on Sunday August 25, 2024 @07:33AM (#41346513)
With sha2 (non truncated) but not with all hash functions eg sha3.
[ Parent | on HN ]
Re:"YOLO" is not a valid hash construction by oconnor663 on Sunday August 25, 2024 @10:30AM (#41347554)
This is confusing two different questions, "How do we hash multiple things at once without breaking the collision property?" and "How do we MAC messages in a way an attacker can't forge?" Length suffixes are answering the first question, not the second.
[ Parent | on HN ]