[saag] Re: [nasr] Re: Re: NASR BOF Follow-Up

Apologies for not paying attention for two months.

>> > Because the values themselves are generally low entropy, so if you
>> > publish their hashes, then it's generally easy to determine the preimage.
>> > 
>> > -Ekr
>> 
>> Would some salt help here (like the salted hashes in sd-cwt)?
>> 
> Probably not very much. What salt does is make it more difficult to amortize computation
> across multiple hashed values. However, if the total number of possible values
> is low (e.g., you have some configuration setting with 3 values) then you can
> just exhaustively search at query time.

I have no idea how NASR would use selective disclosure, but in SD-JWT the salt is part of the disclosure, so it would not be available to someone trying to enumerate claim values without being the recipient of a disclosure.

(Of course, this doesn’t solve the problem that a disclosure for the setting value would need to be made available to an appraiser or endorser or some such, but that is ultimately a process question, akin to selecting an auditor.)

Grüße, Carsten

_______________________________________________
saag mailing list -- [email protected]
To unsubscribe send an email to [email protected]