Hacker News new | ask | show | jobs
by Someone 77 days ago
TLDR: the idea is

- to have a convention to, instead of signing “payloads, to always sign “type identifier + payload”, to prevent adversaries from reusing your signature to sign the same payload, interpreted as a different type.

- use 64-bit type identifiers

- put the identifiers in the IDL (may need augmenting IDL to allow that)

#1 makes sense to me; #3 also makes sense, as that’s the place where people will have to look to learn about your types.

#2, I think, is up for discussion. These could be longer, Java-like strings “com.example.Foo”, or whatever.

I think some people also may disagree with the argument that putting type identifiers inside the payload makes messages too large, but I don’t have enough experience on that to make a judgment.