4 ms·
It seems like the problem is that you need to verify that the file actually exists there with the specified hash, but that isn't the same as having to download
by zrm 10y ago
It seems like the problem is that you need to verify that the file actually exists there with the specified hash, but that isn't the same as having to download it. Is there a way to ask the server for just the hash of a file? You would still have the round trip to the server, but it would be a request for a 32 byte content hash rather than several orders of magnitude more data than that.
- niftich 10y agoOne of the replies to my similar post in the earlier thread [5] was from btrask who proposes a similar scheme, using a manifest placed in .well-known/, on the issue tracker for the W3C SRI spec [6]. The conversation is still ongoing, but see that for advantages and drawbacks, as well as other proposed solutions (and/or join the conversation!) [5] https://news.ycombinator.com/item?id=13495482 https://news.ycombinator.com/item?id=13495482 [6] https://github.com/w3c/webappsec-subresource-integrity/issues/22 https://github.com/w3c/webappsec-subresource-integrity/issue...
- Chris2048 10y agoYou mean a proof-of-existence challenge? You create a salt, send it to server. The server adds the salt to the file, hashes it, then sends the hash back. You check this against the cached data. When the hash doesn't match, you know either the cached version, or the server version, is wrong.