Public SourceMage Discussion List

["Sergey A. Lipnevich" <sergey AT optimaltec.com>]

Quoting Seth Alan Woolley <seth AT positivism.org>:

> Adding a length to a hash outside the hash is one more level of
> difficult for an attacker attempting to use massive appends to gain a
> collision (which is a totally different way than the technique above).
> Sergey is trying to prevent:
>
> sfsfasdfs = 46643
> sfsfasdfsfsdfasdfamaliciouscodefsdfsdfadfd = 46643
>
> Completely different problem.

Yes, that's what I meant. Using "massive append" would be impossible if we
include the length. However, what I don't know is what's the easier way 
to find
a collision: looking for different data of the same length, or
appending/removing data. If the latter is a trivial task, we will improve the
chances against hash collision significantly. But if collision by
appending/removing bytes is difficult, we're not going to gain much 
protection.

> See extract from the article you already linked to :):

I should read this article...

Thanks,
Sergey.