x.comtoolTrail of Bits (@trailofbits) on X
Trail of Bits announces SequenceHash, a library for hashing several inputs without concatenation ambiguity. Plain concatenation lets different input sequences produce the same SHA-256 digest. SequenceHash appends each input's length as a fixed 128-bit integer so every sequence has a single encoding. It ships for Rust, Go and Python, and removes a recurring bug class in crypto and appsec code.
TL;DR Trail of Bits' SequenceHash (Rust, Go, Python) length-prefixes inputs with 128-bit integers to prevent SHA-256 concatenation collisions.
Technologies named here
Techniques named here
- Concatenation ambiguity when hashing several inputs
- Length-encoding defense
Related in AppSec
github.comadvisoryFlowise MCP Security Bypass Enables RCE
huntress.comwriteupInside an Oracle Database SQL Injection Attack | Huntress
github.comrepoOASIS
blog.trailofbits.comwriteup