2 ms·

Does that really help? Unless the hashing algorithm is also a secret, an attacker with the full database of fingerprint hashes would still be able to take a ran

by eli 11y ago

Does that really help? Unless the hashing algorithm is also a secret, an attacker with the full database of fingerprint hashes would still be able to take a random fingerprint, hash it, and then see if they have any OPM records -- isn't that the main threat scenario here? I guess it would make it harder for an attacker to manufacture and plant false fingerprints?

viraptor 11y ago
That's where salt idea comes in. Even if you know the hashing algorithm and the key, you still need to rehash it for every single entry in your database to check if you have a match. That assumes you can get a consistent description of a fingerprint though, or have some scheme for fuzzy match with hashing. Now I want to find a paper on this...