4 ms·
Honestly, I thought this line wasn't very clear, at least if I understand it correctly. It is not important that modification produces a "very" different hash,
by default-kramer 10y ago
Honestly, I thought this line wasn't very clear, at least if I understand it correctly. It is not important that modification produces a "very" different hash, even a minimally different hash is still different enough. What is important is that it is computationally infeasible to generate a collision. So if your evil plan is to modify someone's .js file and then play with comments/whitespace until the hashes match, you and the website will both be dead before you find the collision.
- braveo 10y agono, it be "very different" means you can't do things like generate a hash of all dictionary entries and identify when someone has a password that's only a slight change from a known dictionary entry. It's absolutely important in the security of hashes.
- noway421 10y agoAvalanche effect is a sign of a good hashing algorithms, but not necessarily all of them. It is very vital in case of SRI indeed, as because SRI also intended to shield from potential MITM somewhere in CDN stack. But SRI is useful in other areas too. For example for really bare version handling and for handling (somewhat) gracefully corrupted cdn responses (including errors, empty responses etc). For that, avalanche effect is not all that necessary and CRC32 could do an ok job too.
- bartl 10y agoIt's very important in the storage of hashed passwords, but not in checking the integrity of files, which is the use case here.
- Dylan16807 10y agoFor this purpose, a theoretical CDN-hash that gives an incrementing ID number for every file ever stored in a CDN would work just fine.