Re: [hash2] Comments

From: Vinnie Falco (vinnie.falco_at_[hidden])
Date: 2024-12-07 00:06:25

On Fri, Dec 6, 2024 at 3:22 PM Ivan Matek <libbooze_at_[hidden]> wrote:

> could you tell me under which category is the following example?
> https://pdimov.github.io/hash2/doc/html/hash2.html#example_md5sum
>

Those users are not listed in my taxonomy but they could be listed thusly:

5. Users who need to computed a cryptographic or secure hash function
directly on binary data

There are uncountably many of such users, yet Hash2 is not designed
primarily for them. Although it is quite handy to be able to use the
cryptographic primitives that Hash2 does provide, when they are needed. For
example here:

https://github.com/boostorg/beast/blob/33cfc5653cb57bc0ebe189af007a685714e98a69/include/boost/beast/websocket/detail/hybi13.ipp#L51

> Those are the usecases which I was "targeting" with hard to misuse wrapper
> since I presume:
> - if library was successful those kind of uses will be most common
> - knowledge of preconditions to use library of average end users is lower
> on average than those of library implementers(here talking about both Hash2
> library and some other library that uses Hash2 framework to add new hash).
>

We should not over-engineer result() past the level of what is already
common practice in other cryptographic libraries, since they serve the same
user base. For example the API that Beast copied from another library
simply uses init(), update(), and finish():

https://github.com/boostorg/beast/blob/develop/include/boost/beast/core/detail/sha1.hpp#L63

Hash2 should work the same way. And I think the member function result()
should be changed to a verb like finalize(). And we should provide more
guidance and language around its behavior. I will have more to say on this
in another post.

Thanks