Hacker News Reader

I always liked the ipfs concept of a multihash where a hash algorithm id is stored with the hash, I don't know how well it worked in practice, but in theory all applications of the protocol are now forced into a world where there are multiple hash formats and it can and will change.

View on HN

We don't need that. Introducing an unknown hash algorithm itself is a security issue.

This problem isn't hard or new. Just look at things like a TLS handshake. You need to separate the protocol from the storage implementation.

I personally believe the initial Git programmers were too in love with the efficiency of doing a bitwise 160 bit comparison on the stack and they sacrificed the known issue of changing the algorithm to do it. A decade earlier the same thing had happened with MD5.

Reply on news.ycombinator.com