Thread

1. EPWN3D · 1789618746 · focus · HN ↗

   > Before signing, the encoder fills the field with a placeholder (0), repeated for the field's exact length - signs the entire payload including that placeholder, and then writes the real signature over the top of it. To verify, you put the placeholder back.

   I hate shit like this. Do not let your crypto layer know about the structure of what it's signing. Keep security stupid.

   1. woodruffw · 1789620140 · focus · HN ↗

      As far as compact encodings go, this kind of patch-and-fill technique isn't particularly egregious. The alternative mentioned (where the verifier has to be aware of a bitfield that defines the to-be-signed elements) is much easier to mess up!

Unofficial Hacker News client; not affiliated with Y Combinator.