Hey really enjoying your tutorial so far! One suggestion for problem 06: it wasn't obvious to me that in order to get the matching hash value of "Hello, World!" using sodium.crypto_generichash we need to use an output buffer of 32 bytes. Perhaps it was your intention to have people figure this out on their own, but if you'd like to make it more straightforward you might consider including this info. Looking forward to getting through the rest of this!

At the state we have the bank at the end of 09, it is open to replay attacks as long as someone has access to the log to alter it. All they need to do is to copy an existing command to the end of the log (with a valid hash, which they can easily calculate) and reuse the signature.

As far as I can see, we can mitigate this by signing not the value but the hash. As the hash for each entry is unique, this should thwart replay attacks.

Would you like a PR to the text with these changes?

Hi,

I find the repository really interesting, but I guess it's missing important examples of using crypto with SOAP requests (and by extension, SAML), which are massively used in enterprise applications

It might be worth mentioning that the genesis entry should not be written to the file or stored in the log (otherwise, if it is removed, the reduce function will start with the new 1st entry in the accumulator and the 2nd entry in the current and the first entries details can be modified without detection).

Also, as we’re not saving the hash of the whole log, entries can be deleted from the end without detection.

Is it worth addressing these in the text?

This might be overly critical, but I am slightly concerned that the usage of Yiddish-sounding lingo like "schmeckels" in the context of banking is venturing into antisemitic territory.

Unfortunately conspiracy theories of Jewish people controlling the financial markets are alive and kicking, and I feel that this is something that should not be propagated further.

Maybe there is a little more neutral term that can be used instead? Thanks.

P.S.: I am not under the impression that the current usage intends to convey anything in any way, I am just worried it might be understood that way.