Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:58996
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.220.170 as permitted sender)
References: <CAJWj5+HwwLCzc2QXkYgTba+6CT5Liae3ZG2TrCThqx+C6mkS8A@mail.gmail.com>
 <CAJWj5+HPtUTnmqC83AasB8SqaPBBY98sEivBjDrwkaMMfjzuZA@mail.gmail.com>
 <4F65267D.3040005@googlemail.com> <4F652868.7070901@sugarcrm.com>
 <CAHMUw2H3MrN_1kgqyL++FYp-F8y2W1GGNsgBqrNMzfvL4E15gg@mail.gmail.com>
 <4619201592745010989@unknownmsgid> <8053D167-CC6F-42C6-A589-E33B62EEF31A@gmail.com>
In-Reply-To: <8053D167-CC6F-42C6-A589-E33B62EEF31A@gmail.com>
Mime-Version: 1.0 (1.0)
Date: Sun, 18 Mar 2012 15:17:58 +0800
Message-ID: <-9209664143670810770@unknownmsgid>
To: Tjerk Meesters <tjerk.meesters@gmail.com>
Cc: Tjerk Anne Meesters <datibbaw@php.net>, Stas Malyshev <smalyshev@sugarcrm.com>, 
	Sam <sam.e.giles@gmail.com>, "internals@lists.php.net" <internals@lists.php.net>
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
Subject: Re: [PHP-DEV] Randomize hash-function in php
From: laruence@gmail.com (Xinchen Hui)

Sent from my iPhone

=E5=9C=A8 2012-3-18=EF=BC=8C15:05=EF=BC=8CTjerk Meesters <tjerk.meesters@gm=
ail.com> =E5=86=99=E9=81=93=EF=BC=9A

> On 18 Mar, 2012, at 2:32 PM, Xinchen Hui <laruence@gmail.com> wrote:
>
>>> What if php uses salts for specific hashes only, such as GPC (or all
>>> hashes whose lifetime is limited to the current reuqest), and use a
>>> zero-value salt for all others?
>> definitely no=EF=BC=8Cthinking of pre-calculated hash.
>
> Pre-calculated hash of what? You mean binary serialisation?
>
>> Or Ajax which use
>> json_decode parse input json.
>
> That would be considered a request lifetime hash and therefore could be s=
alted.
>
>>
>> IMO, this Make no sense but mess things up.
>
> We all have opinions. If a clear distinction between vulnerable and non v=
ulnerable data can be reliably made, in my limited knowledge of the whole e=
cosystem I genuinely think this has a shot :)
>
Ha, sorry for my rude words, I am not meaning you=EF=BC=8C but the point se=
lf;)

And it's also why I am not usually saying words at internal@ , my poor
English :)