-
Notifications
You must be signed in to change notification settings - Fork 56
Open
Description
Goal
As per ipld/js-car#123 we do need a solution for verifying hashes in CAR files without shipping all the MultihashHasher-s with the CAR library.
Proposal
Define a separate MultihashVerifier
interface that can be implemented by all of our hashers. It could look like this:
export interface MultihashVerifier {
// Fails if source produces a different multihash
verify(mustihash: Uint8Array, source: Uint8Array): Await<{}>
}
You may be thinking can't I just use MultihashHasher
to create a digest from the source and then compare. While you could there are some subtle cases where having MultihashVerifier
would be a better option:
- Hashing algorithms like blake3 provide incremental verifiability, allowing a more optimal implementation strategy.
- It is possible to implement e.g.
trust: (config) => MultihashVerifier
that could be leveraged as an explicit opt-out as opposed to subtle option that is easy to miss.
Metadata
Metadata
Assignees
Labels
No labels