Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

I think I know: only use as directed.

Only use a crypto component for the exact purpose that is stated on the tin. Hash function turns lengthy text into a short unique digest. That's the only thing you can use it for. If you try to use it for any other purpose, you will likely screw it up.



Sure, but you need to then do something with that digest. Store it, compare it against other digests, etc. Whether or not those actions constitute "crypto" is hard to determine.

For example, git uses SHA-1 digests as unique identifiers for commits. Isn't that extending hash functions from unpredictable digest to identity? What happens when someone finally finds a SHA-1 collision? When Linus made that choice, was he breaking the rule about writing your own crypto?


He was inventing his own crypto. The point is not to avoid design decisions that reinvent crypto, the point is to recognize that's what you're trying to do and seek expert help to guide your hand.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: