2 ms·
To make things simpler for our discussion, I made as example the length extension attack, but message||secret has other more subtle issues (there is extensive d
by antirez 11y ago
To make things simpler for our discussion, I made as example the length extension attack, but message||secret has other more subtle issues (there is extensive documentation about it and many papers detailing the attacks. A more robust way that is still weak compared to HMACs is secret||message||secret). So you gain security by using an HMAC. Given all the above you may want to update the sentence "The author says SHA1_HMAC would make IDs "very hard" to predict compared to SHA1, but this is not true at all", for the sake of other readers not following the whole discussion.
- mrb 11y agoAgain, your H(counter+seed) solution for generating unique IDs is perfectly fine. This is clean, neat and fast. There are no subtle issues whatsoever. An HMAC will not give you any extra security in this case. (The issues with H(message+secret) only exist when the attacker has some control on "message", but he does not in your case --I am familiar with this, I do crypto reviews for a living.) I cannot update my comment (HN only lets you edit posts < 2 hours old), but I would not want to update it anyway since what I say is true :) However I think you should edit your blog post and mention that the order of concatenation of the counter and seed is important. If you want say something along the lines of "HMAC is traditionally the best practice but in this case H(counter+seed) is fine".