3 ms·
This wouldn't work would it? If the server sends the client a number (n), surely, I (as a spammer), could simply pre-calculate the largest integer (p) where the
by tomgallard 15y ago
This wouldn't work would it? If the server sends the client a number (n), surely, I (as a spammer), could simply pre-calculate the largest integer (p) where the hash starts with 0000. The server cannot verify this is the wrong answer, without calculating all the hashes between n and p.
So I can send back p as my answer for all values of n, without needing to do any client side calculation
- dchest 15y agoYou're right, the server needs to send additional unique information, as in http://en.wikipedia.org/wiki/Hashcash http://en.wikipedia.org/wiki/Hashcash Server: uniq_id = long random string salt = long random string work_number = random integer storage[uniq_id] = salt send(uniq_id, salt, work_number) Client: new_number = work_number while hash[:4] != "0000" hash = hashfunc(salt | new_number++) send(uniq_id, new_number) Server: salt = storage[uniq_id] if no salt deny delete from storage[uniq_id] if hashfunc(salt | new_number)[:4] != "0000" deny else allow May also add timestamps.