54 lines
2.0 KiB
Markdown
54 lines
2.0 KiB
Markdown
# PR#74: Fingerprints of 128 Bits
|
|
|
|
> **WARNING:** This document describes only the change applied in this PR.
|
|
> It may already be outdated once the next PR is merged.
|
|
> Historic PR documentation is not maintained along with new PRs; treat it as a snapshot.
|
|
|
|
## Related Links
|
|
|
|
- [PR#73](https://git.javagil.de/mi/werkrevisor/pulls/73): an approval survives a rebase.
|
|
|
|
## The Problem
|
|
|
|
PR#73 was merged at the head that the user approved, while its last review was still running.
|
|
That review found that a fingerprint of 64 bits is too short:
|
|
the PR author writes both the approved and the later block,
|
|
so a birthday attack finds two blocks with the same fingerprint after about 2^32 tries.
|
|
The fix and the removal of a Werkbaum node that belongs to Werkregie came after the merge.
|
|
|
|
The merge also shows a gap in the gate:
|
|
a human approval that came before the review ended unlocked an ORANGE whose finding the human had not seen.
|
|
|
|
## Non-Goals
|
|
|
|
- No fix of the gap in the gate; the Werkbaum plans it as `#gate.after`.
|
|
|
|
## The Scenarios
|
|
|
|
### Feature: a fingerprint cannot be forged
|
|
|
|
#### Scenario#74.01: a fingerprint has 128 bits
|
|
|
|
So that a PR author cannot make a harmful block look approved.
|
|
|
|
- **Given** a human approved a head with a harmless block
|
|
- **And** a later head has a harmful block instead
|
|
- **When** werkrevisor compares the two heads
|
|
- **Then** it counts the harmful block as new
|
|
- **And** a block made to look the same would cost the author about 2^64 tries
|
|
|
|
##### Verified by
|
|
|
|
- [test_carry_over.BlocksTest.test_a_fingerprint_has_128_bits](../../tests/test_carry_over.py)
|
|
|
|
## The Solution
|
|
|
|
- A fingerprint has 32 hex characters, so a collision costs about 2^64 hashes.
|
|
- A PR keeps fingerprints for at most 1000 blocks, so that the result comment stays small.
|
|
- Version 0.32.1.
|
|
|
|
## Additional Changes
|
|
|
|
- The Werkbaum loses the node `#werkregie.pwa`: it belongs to the Werkbaum of Werkregie.
|
|
- The Werkbaum plans `#gate.after`: an approval counts only when it came after the result comment of its head.
|