Re: [xmpp] IQ Handling vulnerabilities

[Alexander Holler <[e-mail]>]

Am 11.02.2014 18:59, schrieb Alexander Holler:

> To play with that hash of hash, is it possible that the hash of a hash
> is the hash itself? If that ever happens your system will have a
> problem, so how likely is that? And in the proposed solution it's a bit
> more difficult, because only the higher 5 bytes of the 20 bytes long
> hash are used. At least for me, the answer to that isn't obvious.

To become completely offtopic, one could formalize that question to how 
the possibility is that

sha1^n(x) = sha1(x) for 2 < n <= 100

(if you need that 100  IDs in series are unique) and furthermore you 
have to look at the upper 5 bytes. I'm not sure if that is what 
cryptographers usually do look at if they check hash algorithms. So 
argueing with whatever they found out about sha1 doesn't look obvious to me.

Regards,

Alexander Holler