-
Notifications
You must be signed in to change notification settings - Fork 10
Closed
Labels
Description
When updating a key, if the CRC32 of the payload and the length of the payload matches with the existing data and length, the update is skipped. This was on the original specifications to avoid non-needed. But after investigation, rely on CRC32 and length it not enough, it seems to be quite easy and probable that same CRC32 with same length occurs even on small dataset with different payload.
Since sha1 is implemented for secure challenge, it's possible to reuse the hashing function. When CRC32 and length matches (which should not happen often, depending on the use case), it would be more safe to fetch old data, check the hash and compute the hash of the new data and ensure it's the same or not.