Hacker News Reader

Comment by londons_explore | Hacker News Reader

"Check the first 4 bytes of" should be banned in crypto code.

Either I want something to match, in which case check it all, or I don't care if it matches, in which case don't check at all.

Why would you ever check 4 bytes?

To me it smells like a way to prevent fuzzers stumbling on a deliberate loophole.

View on HN

This is perhaps the most confusing element of it all, to me. I can hardly imagine a legitimate reason to do this. Defeats entirely the purpose of a hash.

Checking whole hash was probably too slow, you can imagine they put in a check for first four bytes, if that matched then check the whole hash - probably merge conflict and lost the second bit - doesn’t seem too far fetched!

Maybe somebody thought of short sha-1 id's of git: https://git-scm.com/book/en/v2/Git-Tools-Revision-Selection With that only 4 chars is enough to identify a commit :-)

If I understood it correctly, the purpose of this hash is just to shorten the method signature (name+types) to a 4 byte identifier. Unless a contract has thousands of methods, the chance of collision is very low (and the compiler could detect any collision, since it can see all methods). The "legitimate reason" for shortening the method signature is probably just to save space; bytes on distributed blockchain transactions are expensive.

This blew me away. That's 2^32. They took a cryptographic hash, with good preimage/second-preimage/collision resistance, and then discarded 7/8 of it before comparing to ensure some user-provided input is valid. What in the world?!

Reply on news.ycombinator.com