2.0 KiB
PR#74: Fingerprints of 128 Bits
WARNING: This document describes only the change applied in this PR. It may already be outdated once the next PR is merged. Historic PR documentation is not maintained along with new PRs; treat it as a snapshot.
Related Links
- PR#73: an approval survives a rebase.
The Problem
PR#73 was merged at the head that the user approved, while its last review was still running. That review found that a fingerprint of 64 bits is too short: the PR author writes both the approved and the later block, so a birthday attack finds two blocks with the same fingerprint after about 2^32 tries. The fix and the removal of a Werkbaum node that belongs to Werkregie came after the merge.
The merge also shows a gap in the gate: a human approval that came before the review ended unlocked an ORANGE whose finding the human had not seen.
Non-Goals
- No fix of the gap in the gate; the Werkbaum plans it as
#gate.after.
The Scenarios
Feature: a fingerprint cannot be forged
Scenario#74.01: a fingerprint has 128 bits
So that a PR author cannot make a harmful block look approved.
- Given a human approved a head with a harmless block
- And a later head has a harmful block instead
- When werkrevisor compares the two heads
- Then it counts the harmful block as new
- And a block made to look the same would cost the author about 2^64 tries
Verified by
The Solution
- A fingerprint has 32 hex characters, so a collision costs about 2^64 hashes.
- A PR keeps fingerprints for at most 1000 blocks, so that the result comment stays small.
- Version 0.32.1.
Additional Changes
- The Werkbaum loses the node
#werkregie.pwa: it belongs to the Werkbaum of Werkregie. - The Werkbaum plans
#gate.after: an approval counts only when it came after the result comment of its head.