From 0ac70b268accded4d7f1c563eca7048ff95d1658 Mon Sep 17 00:00:00 2001 From: Andrew Morgan Date: Thu, 25 Jul 2019 18:55:57 +0100 Subject: [PATCH] Clarify peppering should not happen on none algo --- proposals/2134-identity-hash-lookup.md | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/proposals/2134-identity-hash-lookup.md b/proposals/2134-identity-hash-lookup.md index 0151808b..0eb996be 100644 --- a/proposals/2134-identity-hash-lookup.md +++ b/proposals/2134-identity-hash-lookup.md @@ -143,10 +143,10 @@ agree upon this, the value `"none"` can be added to the `"algorithms"` array of `GET /hash_details`. The client can then choose to send plain-text values by setting the `"algorithm"` value in `POST /lookup` to `"none"`. -No hashing will be performed if the client and server decide on `"none"`, and -3PIDs will be sent in plain-text, similar to the v1 `/lookup` API. When this -occurs, it is STRONGLY RECOMMENDED for the client to prompt the user before -continuing. +No hashing nor peppering will be performed if the client and server decide on +`"none"`, and 3PIDs will be sent in plain-text, similar to the v1 `/lookup` +API. When this occurs, it is STRONGLY RECOMMENDED for the client to prompt +the user before continuing. When performing a lookup, the pepper and hashing algorithm the client used must be part of the request body (even when using the `"none"` algorithm