Recent changes to 118: predictable hash function

#118 predictable hash function

Artyom Beilis — Fri, 23 May 2014 14:11:03 -0000

Interesting point to think about

#118 predictable hash function

Artyom Beilis — Fri, 23 May 2014 14:10:52 -0000

assigned_to: Artyom Beilis
Group: v1.0_(example) --> 1.2

predictable hash function

Anonymous — Tue, 08 Apr 2014 20:02:27 -0000

It's not really a bug, but i think it should be mentioned somewhere in the docs, that the hash_map and hash_map based modules (e.g caching) are not safe for all kinds of user input/user provided data - because of the predictable hash function and the resulting vulnerability to hash-DoS attacks.

Poc:

>>> def weinberg_hasher(inp):
...     h = 0
...     for c in inp:
...         h = (h << 4) + ord(c)
...         high = h & 0xF0000000
...         if high != 0:
...             h = h ^ (high >> 24) ^ high
...     return h & 0xFFFFFFFF
>>> res = [hasher("abc" * len_)  for len_ in range(10000)]
>>> len(res) # values
10000
>>> len(set(res)) # distinct values
5

predictable hash function

Anonymous — Tue, 08 Apr 2014 20:02:27 -0000

Ticket 118 has been modified: predictable hash function
Edited By: Artyom Beilis (artyom-beilis)
milestone updated: u'v1.0(example)' => u'1.2'
Owner updated: None => u'artyom-beilis'