search

amirgamil / zk-crush

Tell your crush you like them with zero-knowledge
https://zkcrush.xyz/
MIT License
230 stars 12 forks source link

Suggestion: Hash a combination of the two names #7

Open FlorentCLMichel opened 2 years ago

FlorentCLMichel commented 2 years ago

First, thanks a lot for making this website and the code open-source! It's a very fun way to illustrate one of the applications of hash functions!

I have a small suggestion to further reduce the amount of information that can be extracted from the hash. If I am correct, the hash is calculated from the crush's name only. So, if two people, say Archibald and Bob, have the same crush, say Charlene Randomfamilyname, both will get the same hash Hash("Charlene Randomfamilyname"). Someone who can see the two hashes thus knows that Archibald and Bob have the same crush. (Or, at least, that the names of their crushes have the same hash, which, if the probability of collision is small enough, means they have the same name with very high probability.)

One possible solution would be to hash a combination of the user's name and that of the crush. In this example, the two hashes would be Hash("Archibald Charlene Randomfamilyname") and Hash("Bob Charlene Randomfamilyname"). Anyone who does not know the name of Archibald's nor Bob's crush would then be able to tell whether they have the same crush without a brute-force attack (assuming, of course, that the hash function and its implementation are secure).

HanSeoulOh commented 2 years ago

I think probably it should be something like Hash("yourname" XOR "theirname") but either way it is still vulnerable to a dictionary attack if you knew either "yourname" or "theirname" as a dictionary could be easily compiled from their social media account.