oss-sec mailing list archives
Re: Re: expat hash collision fix too predictable?
From: Daniel Micay <danielmicay () gmail com>
Date: Sat, 04 Jun 2016 03:07:56 -0400
It's quite questionable for libraries to be calling thread-unsafe functions like rand or strtok at all. AFAIK, expat is supposed to be thread safe and is used in many multi-threaded applications. A proper hash DoS fix is using a CSPRNG to generate keys for a keyed hash with meaningful security properties, like SipHash. It's usually done very poorly, and the quality of the RNG doesn't matter much if key independent collisions can be generated for the hash function anyway.
Attachment:
signature.asc
Description: This is a digitally signed message part
Current thread:
- Re: expat hash collision fix too predictable? Sebastian Pipping (Jun 03)
- Re: expat hash collision fix too predictable? cve-assign (Jun 03)
- Re: Re: expat hash collision fix too predictable? Daniel Micay (Jun 04)
- Re: expat hash collision fix too predictable? Sebastian Pipping (Jun 04)
- Re: expat hash collision fix too predictable? cve-assign (Jun 04)
- Re: expat hash collision fix too predictable? Sebastian Pipping (Jun 04)
- Re: expat hash collision fix too predictable? cve-assign (Jun 03)