34 ms·
Why not use CRC32, or even better the MD5 on file, as the base hash, and then do a XOR with your secret key.
by nreece 19y ago
Why not use CRC32, or even better the MD5 on file, as the base hash, and then do a XOR with your secret key.
- brianr 19y agoXOR with the secret key sounds like a good idea... hashing the whole file won't work though, since I want to check the hash before generating the file--I'm hashing the URL to prevent an attacker from asking the server to generate billions of images. Think it will still work well if the input is only 20-30 characters?
- deleted 19y ago[deleted]
- cperciva 19y agoReally really bad idea -- an attacker wouldn't need the secret key to generate collisions, since collisions in hash(X) are also collisions in hash(X) xor [secret key].
- jgrahamc 19y agoUsing that I should be able to recover your secret key trivially. I submit an image to the site, since I can work out MD5(image) I can just XOR with the hash you've assigned and get the secret key.