Post #2336642
2026-05-06 21:51 UTC
@grawity@social.treehouse.systems The sweet spot of prefix length is also an open question. There are 6.3M primary keys in the live SKS dataset, and a similar number of subkeys. To have a reasonable anonymity cohort of >1k you would have to have a prefix length of <16 bits. But it's trivial to mass-generate hash collisions for prefixes that short, so we're also opening the temptation of a vandalism attack.
Replies (1)
-
@andrewg@mastodon.ie 2026-05-06 22:00
@grawity@social.treehouse.systems a solution to that issue would be to calculate the prefixes in some way that is infeasible for an attacker to precompute, but trivial to check by the client after the fact. Say, by using a merkle tree with inclusion proofs. But now we're getting into the realm of certificate transparency.