diff options
| author | Jack O'Connor <[email protected]> | 2022-03-03 12:06:14 -0500 |
|---|---|---|
| committer | Jack O'Connor <[email protected]> | 2022-03-03 12:06:14 -0500 |
| commit | 3e67a8f45bcfa906da53728f5f4d09c41fb476d2 (patch) | |
| tree | 6744ce3f0c8afeb50843751c2683c89201da6ac6 | |
| parent | d295410aad19d70e4b7ab9b93b216a77fb8d40e4 (diff) | |
correct the security notes for the C API
| -rw-r--r-- | c/README.md | 3 |
1 files changed, 1 insertions, 2 deletions
diff --git a/c/README.md b/c/README.md index e213704..06e7a00 100644 --- a/c/README.md +++ b/c/README.md @@ -197,8 +197,7 @@ bits of collision resistance, for any N up to 256. Longer outputs don't provide security. Avoid relying on the secrecy of the output offset, that is, the number of output bytes read or -the arguments to [`seek`](struct.OutputReader.html#method.seek) or -[`set_position`](struct.OutputReader.html#method.set_position). [_Block-Cipher-Based Tree +the `seek` argument of `blake3_hasher_finalize_seek`. [_Block-Cipher-Based Tree Hashing_ by Aldo Gunsing](https://eprint.iacr.org/2022/283) shows that an attacker who knows both the message and the key can easily determine the offset of an extended output. For comparison, AES-CTR has a similar property: if you know the key, you can decrypt a block from |