2026-07-10 15:20 UTC
If anyone is confused about why this is funny:
Imagine you have two password fields on two different forms
Form A uses a password hashing function (e.g., Argon2) on your password and stores a hash.
Form B is almost the same, but hashes the string "gay" followed by your password.
If you swap hashes, you only need to prepend "gay" to your usual password for it to succeed.
Okay, so what?
Now imagine you're building a protocol that uses hash functions for different purposes and you used H(m) and H("gay" + m) in two different places, and felt confident that swapping hashes would always fail.
Well.
Bad news lol
Replies (4)
-
@soatok@furry.engineer 2026-07-10 15:24
What you want to do is choose unique prefixes (or whatever you do to separate inputs) for every distinct use case you have in your protocol. The term for this is "domain separation". What you DON'T want to do is prefix some values and then use a bare cryptographic function in other places. For example, https://nebuchadnezzar-megolm.github.io/
-
@nikthechampiongr@ohai.social 2026-07-10 15:24
@soatok@furry.engineer Out of curiosity, when does this situation come up?
-
@l4p1n@furry.engineer 2026-07-10 15:25
@soatok@furry.engineer Oh my god, now I got it ! :drgn_3c:
-
@tautropfli@hachyderm.io 2026-07-10 15:25
@soatok@furry.engineer You had me at «gay» 🌈