3 ms·
I like the conclusion. Is there a standard scheme for hash-function-then-key-derivation? You can easily tell users to run `sha256sum` but... Though I suppose y
by remram 3y ago
I like the conclusion. Is there a standard scheme for hash-function-then-key-derivation? You can easily tell users to run `sha256sum` but...
Though I suppose you should use public-key cryptography (e.g. GPG) if you want users to verify downloads to guard from attacks rather than just errors.
GPG/TLS/... should probably use different fingerprint algorithms though.
- Avamander 3y agoI think it's less about the algorithm, it's more about the representation. If the goal is that users verify these things. SSH displays pubkey art when generating a new key. We've had secret recovery phrases for a while, they're long but really difficult to confuse with each other even if it's just a short glance. I think OpenPGP had something like that even. Then there's also GitHub that generates (or generated at some point) a custom unique profile picture for users. There are many other similar approaches out there. It would be possible to create a standard for representing SHA256/SHA512 hashes as human-comparable images. Possibly enhanced with checksum words or with machine readability for those paranoid (without error-prone OCR).
- remram 3y agoIf your images/list of emojis/phrases are created from the bits of the SHA hash, then similarity there lead to similar images/... You need a hard-to-collide process in the middle anyway.
- Avamander 3y agoA strong hash is already difficult to collide. Your algorithm for representation doesn't have to map similar bytes or byte sequences to similar images, but that's just a mapping not really a "hard-to-collide process".
- remram 3y ago> A strong hash is already difficult to collide I don't understand. The whole point of the article is that this isn't true.