Consider removing the xxhash dependency

[seelabs]

Summary

We currently use xxhash to hash values that are themselves already a sha-256 hash. The code should be audited to see if we could use the sha-256 hash directly and remove the xxhash dependency.

Motivation

It removes a dependency.

Solution

Use a sha-256 hash directly instead of rehashing with xxhash.

[MarkusTeufelberger]

I think xxhash is used in NuDB as a faster and cheaper hash algorithm than sha256.

[seelabs]

@MarkusTeufelberger I was considering cases where we using a sha-256 hash as a key in an hash table. So we're using

xxhash(sha256_hash(value));

I don't think that xxhash is doing anything useful and we could potentially remove it.

[intelliot]

@seelabs do you think this is a Good First Issue?

[JoelKatz]

This would leave us vulnerable to algorithmic complexity attacks. The point of xxhash is that it is unpredictable to an attacker. An attacker can predict the SHA256 hashes of transactions, accounts, and ledger objects they create permitting them to force numerous XRPL algorithms into their worst-case behaviors.

However, if the input is a SHA256 hash, then a simpler algorithm than xxhash could, in theory, be used because all you need is a defense against algorithmic complexity attacks and not any of the other properties xxhash gives us. For example, you could determine a "seed" at start time that chooses which bytes of the SHA256 hash are extracted and used as a key. Then it's just byte extraction.

[seelabs]

I did not understand the purpose of hashing something that was already a SHA256 hash. Thanks for clarifying. I'm going to close this issue.