Leonid Evdokimov

I also think that replacing `PHPSESSID` with something like `SID-$(md5 -s "$(opnsense-version)|$(cat /etc/machine-id)" | python3 -c 'import sys, binascii, base64; print(base64.b64encode(binascii.unhexlify(sys.stdin.read().strip()), altchars=b"==").decode("ascii").replace("=", "")[:7])')` may prevent multiple `PHPSESSID` cookies from appearing...

> I also think that replacing `PHPSESSID` with something like `SID-${machine-id}` It might also be an inferior idea from the security perspective: https://github.com/opnsense/core/pull/8515#issuecomment-3547330784 — it'll enable unsuspecting users shooting themselves...

Speaking of performance impact. My old machine with `Core i7-6600U` and aes-ni support claims to compute: - 405 MiB/s of SHA256 per `openssl speed -evp SHA256 -bytes 262144` - 190...

Please, excuse my habit of high-context messages :-) I was speaking assuming the context of chunker parameter extraction attacks. BTW, [Breaking and fixing content-defined chunking](https://eprint.iacr.org/2025/558.pdf) paper is now available online,...

> using a 64bit hash was suggested by one of these recent CDC security papers If I understand _"Chunking Attacks on File Backup Services using Content-Defined Chunking"_ paper correctly, that...

> I recently added the padme algorithm That's beautiful design. It adds ≈3% overhead for megabyte-sized chunks while having guarantees well-described in the paper: ["Reducing Metadata Leakage from Encrypted Files...