Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:59006
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.212.182 as permitted sender)
Message-ID: <4F66078E.1080100@gmail.com>
Date: Sun, 18 Mar 2012 17:04:30 +0100
User-Agent: Thunderbird
MIME-Version: 1.0
To: Tjerk Anne Meesters <datibbaw@php.net>
CC: Stas Malyshev <smalyshev@sugarcrm.com>, Sam <sam.e.giles@gmail.com>, 
 "internals@lists.php.net" <internals@lists.php.net>
References: <CAJWj5+HwwLCzc2QXkYgTba+6CT5Liae3ZG2TrCThqx+C6mkS8A@mail.gmail.com> <CAJWj5+HPtUTnmqC83AasB8SqaPBBY98sEivBjDrwkaMMfjzuZA@mail.gmail.com> <4F65267D.3040005@googlemail.com> <4F652868.7070901@sugarcrm.com> <CAHMUw2H3MrN_1kgqyL++FYp-F8y2W1GGNsgBqrNMzfvL4E15gg@mail.gmail.com>
In-Reply-To: <CAHMUw2H3MrN_1kgqyL++FYp-F8y2W1GGNsgBqrNMzfvL4E15gg@mail.gmail.com>
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit
Subject: Re: [PHP-DEV] Randomize hash-function in php
From: keisial@gmail.com (=?ISO-8859-1?Q?=C1ngel_Gonz=E1lez?=)

On 18/03/12 06:56, Tjerk Anne Meesters wrote:
> On Sun, Mar 18, 2012 at 8:12 AM, Stas Malyshev <smalyshev@sugarcrm.com> wrote:
>> Obvious solution would be to use a salt for the hash, which prevents blind
>> pre-computing of hash collisions. However, due to the fact that PHP hash
>> values can be reused in different processes by bytecode caches, implementing
>> it properly is not trivial.
> What if php uses salts for specific hashes only, such as GPC (or all
> hashes whose lifetime is limited to the current reuqest), and use a
> zero-value salt for all others?
We'll need to have at least two kind of hashes, at that point, I think
it makes sense
to place the salt as a member of the HashTable struct. Bytecode caches
would just
store the salt with the hash. We can also mt_rand() the salt of each
hash, for further
randomization.