<html><head><meta http-equiv="Content-Type" content="text/html charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">Gentlefolk,<div class=""><br class=""></div><div class=""><br class=""></div><div class=""><br class=""></div><div class=""><span class="Apple-tab-span" style="white-space:pre"> </span>Once again I come with what appears to me to be a simple design choice informed by implementation realities. But in the world of crypto, there are always unseen by me issues. Thank you in advance for any insight you care to share.</div><div class=""><br class=""></div><div class="">The scene:</div><div class=""><br class=""></div><div class=""><span class="Apple-tab-span" style="white-space:pre"> </span>I want to sign a BLOB for a counter party. What constitutes the hash we sign? Normally, I would hash the identifying preamble information followed by the bytes of the BLOB, hash(preamble || BLOB). Life is good. That would be the preferred pattern and I would normally be happy with that.</div><div class=""><br class=""></div><div class=""><span class="Apple-tab-span" style="white-space:pre"> </span>In this situation though, we must factor in time. The BLOB could be quite large and, for good legal reasons, I’m requiring that it must be completely under my control before countersigning. For scaling purposes though, I do not have all of the preamble information when the BLOB is being uploaded. Calculating the hash of the BLOB could take some time. An answer would be to calculate the hash as the BLOB arrives and use that hash in the signature hash. As in hash the identifying preamble information followed by the hash of the BLOB, hash(preamble || hash(BLOB)). This, of course, results in a different hash value. </div><div class=""><br class=""></div><div class=""><span class="Apple-tab-span" style="white-space:pre"> </span>hash(preamble || BLOB) != hash(preamble || hash(BLOB))</div><div class=""><br class=""></div><div class="">To my cryptographically unsophisticated eye, they look to be equivalently secure. Are they? My trusty copy of "Cryptography Engineering" appears to be silent on this issue. Any opinions?</div><div class=""><br class=""></div><div class=""><br class=""></div><div class=""><br class=""><div class="">
<div style="color: rgb(0, 0, 0); letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><div style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">Anon,<br class="">Andrew<br class="">____________________________________<br class="">Andrew W. Donoho<br class="">Donoho Design Group, L.L.C.<br class=""><a href="mailto:awd@DDG.com" class="">awd@DDG.com</a>, +1 (512) 750-7596, <a href="http://twitter.com/adonoho" class="">twitter.com/adonoho</a><br class=""><br class=""><div style="color: rgb(0, 0, 0); font-family: Georgia; font-size: 14px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px;">Doubt is not a pleasant condition, but certainty is absurd.</div><div style="color: rgb(0, 0, 0); font-family: Georgia; font-size: 14px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px;"> — Voltaire</div><div style="color: rgb(0, 0, 0); font-family: Georgia; font-size: 14px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px;"><br class=""></div></div></div><br class="Apple-interchange-newline">
</div>
<br class=""></div></body></html>