5 ms·
Loving this. I wonder how people even come up with an idea of truncating hashes. For what purpose or benefit?
by nrvn 2y ago
Loving this. I wonder how people even come up with an idea of truncating hashes. For what purpose or benefit?
- ffk 2y agoSometimes it’s done to fit into an existing tool/database that has a preexisting limit. Or when the hash is used only as a locator rather than for integrity. Not a good practice imo but people are pragmatic.
- bflesch 2y agowhen you upgrade from sha1 to sha256 but you don't want to change your data format for storing the integrity checks / keys.
- epcoa 2y agoA SHA-1 is not 12 characters (either in digest bytes or hex nibbles)
- iforgotpassword 2y agoTruncated hash functions are not vulnerable to length-extension attacks. But you usually take SHA512 and truncate to 256 bits. Anything shorter than this isn't really considered safe these days.
- ajb 2y agoAccording to the commit, they did it to reduce the length of the downloaded filename and URL.
- naasking 2y agoFor when you need a smaller payload: According to @Reid's answer in [2] and @ThomasPornin's answer in [3], the idea of truncating hashes is fully supported by NIST, in fact SHA-224 is just SHA-256 truncated, SHA-384 is just SHA-512 truncated, etc. https://security.stackexchange.com/a/97389 https://security.stackexchange.com/a/97389