3 ms·
Simply hashing your data (using an established hashing algorithm/library combo) to later compare two hashes in order to check whether the data has changed doesn
by ludwik 2y ago
Simply hashing your data (using an established hashing algorithm/library combo) to later compare two hashes in order to check whether the data has changed doesn’t usually feel like rolling your own crypto.
- nabla9 2y agoThe use case was KDF and they decided to do simple password hash signature hack instead by combining strings. They fucked it up.
- ludwik 2y agoOf course they fucked it up, as evidenced by their bad security incident. The only question is whether you can really chalk this particular one up to a problem with "rolling your own crypto." That mantra exists for a reason, but it doesn’t feel like it really applies this time. It seems more like they used established crypto—just not the right one for this particular use case.
- nabla9 2y agoConcatenating strings before giving it to the hash function instead of using KFD is rolling your own.