4 ms·
What do you mean by "incremental hashing"? Note that the Init-Update-Finalize API provided by many cryptography libraries doesn't protect against this - calling
by agwa 2y ago
What do you mean by "incremental hashing"? Note that the Init-Update-Finalize API provided by many cryptography libraries doesn't protect against this - calling Update multiple times is equivalent to hashing a concatenated string.
- blueflow 2y agoI mean the same what you call Init-Update-Finalize. link needed about the dysfunctional implementations.
- agwa 2y agoFor example, try running this Go program: https://go.dev/play/p/atvS3j8Dzg- https://go.dev/play/p/atvS3j8Dzg- Or see the Botan documentation that explicitly says "Calling update several times is equivalent to calling it once with all of the arguments concatenated": https://botan.randombit.net/handbook/api_ref/hash.html https://botan.randombit.net/handbook/api_ref/hash.html I've worked with many cryptography libraries and have never seen an Init-Update-Finalize API that works the way you think it does. It does not protect against canonicalization attacks unless you're using something like TupleHash.
- vsl 2y agoNo, these APIs are intentionally designed to be equivalent to hashing all data at once - i.e. to make it possible to hash in O(1) space. There's nothing "disfunctional" about that. "Incremental hash function" has a very different meaning and doesn't seem to have any relevance to what is discussed here: https://people.eecs.berkeley.edu/~daw/papers/inchash-cs06.pdf https://people.eecs.berkeley.edu/~daw/papers/inchash-cs06.pd...
- blueflow 2y agoI guess the PHP documentation is wrong then. Look at this: https://www.php.net/manual/en/function.hash-init.php https://www.php.net/manual/en/function.hash-init.php
- ddtaylor 2y agoFor anyone curious PHP ultimately uses this definition in their introduction portion of the hash extension: > This extension provides functions that can be used for direct or incremental processing of arbitrary length messages using a variety of hashing algorithms, including the generation of HMAC values and key derivations including HKDF and PBKDF2.
- deleted 2y ago[deleted]
- Thorrez 2y agoThat page includes an example that shows PHP's incremental hashing is what you describe as "dysfunctional". It hashes "The quick brown fox jumped over the lazy dog." in 1 part, and in 2 parts, and shows that the resulting hashes are equal.
- blueflow 2y agoI did a mistake.