Re: Thinking aloud.

Hi.

On 10/25/2012 09:58 PM, Nix wrote:
> On 25 Oct 2012, Nigel Cunningham uttered the following:
>> Thanks for your response - I'm no cryptography guru, so it's good to
>> hear from people who obviously know more than I do. I guess the way to
>> go then is to build a table of hashes that have been seen and compare
>> the actual content if/when you get a collision? I suppose that would
>> also help in seeing whether/how often pages have the same content.
> You'd want a debugging option to do that, because reading the old page
> in to compare it is going to be every bit as expensive as writing the
> new one out would have been.
No - I'm only going to do this within the pageset, not across the whole 
image, partly because then both pages are still in memory and can be 
compared with minimal cost. Going through the image on disk would be 
expensive - you'd have to store disk locations and offsets in memory 
because they're all (potentially) compressed and packed together with 
metadata in between.
>> Also, may I ask?: How does checksumming a page compare to using SHA1
>> hashes for git blobs?
> Pretty much the same.
>>                        I've read that Linus isn't concerned about
>> collisions there, but don't fully understand why it's not an issue
>> there, but is here.
> Well, it's not an issue there because it's insanely improbable that it
> would happen by chance, and git hashes are not meant as a security
> feature. It's possibly an issue here because it is quite possible for
> e.g. cryptanalysts to be using Linux and have a page of memory filled
> with something which they *know* will cause a hash collision because
> they've just been studying it!
Ah. It's the security aspect! I wasn't thinking about someone trying to 
corrupt the image on their computer to create a security vulnerability. 
In most cases it won't be a concern (personal laptop/computer) but I 
agree I can't assume "most cases".

Regards,

Nigel