We’re releasing SequenceHash and its sister function SequenceMAC, a pair of related hash constructions that bring secure multihashing to developers using hash functions other than Keccak.
It’s the same class of vulnerabilities as injection attacks. When you are hashing structured data it must be properly delimited to preserve the correct structure regardless of the contents of the data. If you concatenate without delimiters then an attacker can make you treat their malicious data as if it were your trusted metadata.
I kinda guessed that but when the article says it can create many vulnerabilities, an example would be good. And also maybe why a naive approach with custom escaping or length prefixes isn’t enough.
I wish this spent more time explaining the security issue with concatenation.
score 1 · canonical
It’s the same class of vulnerabilities as injection attacks. When you are hashing structured data it must be properly delimited to preserve the correct structure regardless of the contents of the data. If you concatenate without delimiters then an attacker can make you treat their malicious data as if it were your trusted metadata.
score 1 · canonical
I kinda guessed that but when the article says it can create many vulnerabilities, an example would be good. And also maybe why a naive approach with custom escaping or length prefixes isn’t enough.
score 1 · canonical