Public SourceMage Discussion List

["Sergey A. Lipnevich" <sergey AT optimaltec.com>]

Quoting Mads Laursen <smgl AT dossen.dk>:

> On 30/08/05 15.05, Sergey A. Lipnevich wrote:
> > Quoting Seth Alan Woolley <seth AT positivism.org>:
> >
> > >
> > > size of tarball doing what exactly?
> >
> > The first way that comes to mind to generate a hash collision is to add
> > bytes to
> > the file until the collision is achieved. If we include both the hash
> > value and
> > the tarball size in the DETAILS, we're drastically reducing chances of hash
> > collision going unnoticed.
>
> That is actually wrong. Most hash functions use the Merkle-Damgaard
> structure[1], which explicitly include the length in the hashed data,
> in the final block. So actually finding a collision of a different
> length would be (at least) as difficult as finding one of the same
> length. At least, that is how I understand it.

OK, I'm sorry I said that. I knew the fact that the length is included in the
hash calculation, but I had (still have I guess) a very primitive 
understanding
of collision-generation techniques. Apparently there's much more to it. 
Thanks!
I actually learned something in this discussion :-O...

Sergey.