Light

Episode #940 Quiz

When Hashes Collide
Date: 2023-09-19 | Length: 1.75 hrs | Episode page at twit.tv

About this episode

Episode 940 examined HSMs as write-only cryptographic microcomputers that keep private keys out of RAM, using SHA-256 hashes for code signing and verification. It also detailed why SSD secure erase must target FTL-mapped hidden data, why one overwrite pass suffices for modern HDDs, and how deliberate hash collisions enable pseudonymization.

Your name and email are stored only in your browser local storage for convenience. They are not retained server-side.

NameEmail

Question 1: In Steve Gibson’s explanation of his GRC code-signing HSM, what operation does the external signing software perform before sending data into the dongle?

Question 1

In Steve Gibson’s explanation of his GRC code-signing HSM, what operation does the external signing software perform before sending data into the dongle?

It encrypts the full code image with the public key and sends that ciphertext into the HSM It computes a SHA-256 hash of the code and sends the 32-byte result into the HSM It signs the code locally and sends only the completed signature to the HSM for storage It compresses the code into a fixed-size block and sends that block into the HSM

Question 2: According to the episode’s description of secure erasure on SSDs, why do multiple overwrite passes not provide additional security benefit?

Question 2

According to the episode’s description of secure erasure on SSDs, why do multiple overwrite passes not provide additional security benefit?

Because electrostatic storage leaves no residual bit pattern once electrons are removed Because repeated writes only affect the controller firmware, not the data cells Because flash memory cannot be rewritten after initial programming Because SSD controllers always sanitize all spare blocks during every ordinary write

Question 3: What practical purpose did Steve give for using only the lowest portion of a cryptographic hash in Ray’s library pseudonymization use case?

Question 3

What practical purpose did Steve give for using only the lowest portion of a cryptographic hash in Ray’s library pseudonymization use case?

To eliminate the need for any hashing algorithm by making the identifiers reversible To ensure each patron gets a globally unique identifier across all library systems To increase the entropy of the underlying patron records before storage To create deliberate collisions that preserve statistical utility while adding deniability

Question 4: For the 5,000-patron example, what hash size did Steve say produced about a 52.5% chance that any two patrons would collide?

Question 4

For the 5,000-patron example, what hash size did Steve say produced about a 52.5% chance that any two patrons would collide?

Forty-eight bits, or six bytes, of the hash output Thirty-two bits, or four bytes, of the hash output Sixteen bits, or two bytes, of the hash output Twenty-four bits, or three bytes, of the hash output

Question 5: What did Steve say would happen if the drive’s built-in encryption key were replaced with a new randomly generated key?

Question 5

What did Steve say would happen if the drive’s built-in encryption key were replaced with a new randomly generated key?

All previously written data would become unrecoverable nonsense The drive would need to be reformatted before any data could be accessed again Only the free space would become unreadable while existing files remain intact The drive would retain old data unless two full overwrite passes were also performed

Cancel

My Data//Security & Privacy//Clear Local Data

© 2026 Ken ArmstrongSecurity Now™ is a trademark of TWiT LLC. All trademarks and copyrights of the Security Now podcast are respected and reserved to their respective holders.
This is a hobby project made with love and admiration for what Steve Gibson and Leo Laporte have built over 20 years.