Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:79900
Return-Path: <tyra3l@gmail.com>
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Delivered-To: mailing list internals@lists.php.net
Received: (qmail 1727 invoked from network); 24 Dec 2014 01:29:22 -0000
Received: from unknown (HELO lists.php.net) (127.0.0.1)
  by localhost with SMTP; 24 Dec 2014 01:29:22 -0000
Authentication-Results: pb1.pair.com header.from=tyra3l@gmail.com; sender-id=pass
Authentication-Results: pb1.pair.com smtp.mail=tyra3l@gmail.com; spf=pass; sender-id=pass
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 74.125.82.54 as permitted sender)
X-PHP-List-Original-Sender: tyra3l@gmail.com
X-Host-Fingerprint: 74.125.82.54 mail-wg0-f54.google.com  
Received: from [74.125.82.54] ([74.125.82.54:59773] helo=mail-wg0-f54.google.com)
	by pb1.pair.com (ecelerity 2.1.1.9-wez r(12769M)) with ESMTP
	id B0/20-33035-FE61A945 for <internals@lists.php.net>; Tue, 23 Dec 2014 20:29:20 -0500
Received: by mail-wg0-f54.google.com with SMTP id l2so10347990wgh.27
        for <internals@lists.php.net>; Tue, 23 Dec 2014 17:29:15 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
        d=gmail.com; s=20120113;
        h=mime-version:in-reply-to:references:date:message-id:subject:from:to
         :cc:content-type;
        bh=6UkCK7ripWdJ/NEpeWyakZznfTgedhn/auKar8r/QsY=;
        b=FOja60nNJAcFGLZXnhinyy2r3uN6XhBlHx0YJ5GoktYvJFVqWp4/JvwE4zjnicSnTv
         0hLQ0u4tEL/96ibDfHg8pfAll4BGCi8Xz2H1x9z3415Nz+kWV43vx7DXYSgRjU4oNdmE
         WhswPPR7dWC4wx+bRMOjjgz2sRH3rs3YgGINPshbXR/EMCkDxR387kizgZxd+M+QMQsv
         L+QTzKYo2fDG2f+o6hi2JkeRz/iqtqOL17Cqzwk3oeNQ3MsqGYqOUlhKW7q05bbSt9hI
         JQZvnHL9UuU+zmVh/Q6XRRgrBolZU1h94rnrWY1gsv6d9VcoxhXe5QcdreV5R169MBN7
         FaLA==
MIME-Version: 1.0
X-Received: by 10.194.174.72 with SMTP id bq8mr56261509wjc.120.1419384555093;
 Tue, 23 Dec 2014 17:29:15 -0800 (PST)
Received: by 10.180.88.33 with HTTP; Tue, 23 Dec 2014 17:29:15 -0800 (PST)
In-Reply-To: <CAGa2bXZchck1uNvW=4HVRF7Y4km4deqZ9C0bCU4JzVQJnmOjGQ@mail.gmail.com>
References: <CAPKwhwsNbjeiMjb=yxNOVAXTBGWpT+Cm6X5Q1peT=_TOLGThxg@mail.gmail.com>
	<CAEZPtU7UfK7CApn=86q-G3WS1uKpiuVqLy7fdwv1vg5v0kDt7Q@mail.gmail.com>
	<CAGa2bXZchck1uNvW=4HVRF7Y4km4deqZ9C0bCU4JzVQJnmOjGQ@mail.gmail.com>
Date: Wed, 24 Dec 2014 02:29:15 +0100
Message-ID: <CAH-PCH7bB3pKEeWaQC9DQGFHFB1R8O=Xp3SYyTg7Upa1dGTqOA@mail.gmail.com>
To: Yasuo Ohgaki <yohgaki@ohgaki.net>
Cc: Pierre Joye <pierre.php@gmail.com>, Scott Arciszewski <kobrasrealm@gmail.com>, 
	PHP internals <internals@lists.php.net>
Content-Type: multipart/alternative; boundary=089e013d1a6434c6aa050aec3844
Subject: Re: [PHP-DEV] JSON HASHDOS
From: tyra3l@gmail.com (Ferenc Kovacs)

--089e013d1a6434c6aa050aec3844
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

On Tue, Dec 23, 2014 at 9:12 PM, Yasuo Ohgaki <yohgaki@ohgaki.net> wrote:

> Hi,
>
> On Wed, Dec 24, 2014 at 4:51 AM, Pierre Joye <pierre.php@gmail.com> wrote=
:
>
> > This issue has been reported earlier on security@php.net and is being
> > discussed and analyzed. It is not a simple task.
> >
>
> If we are not going to use other hash (i.e. half MD4 like other langs), h=
ow
> about
> add max allowed collisions? It would be simple and fast enough. I'm not
> looking
> at the code, so I could be wrong.
>
> Regards,
>
> --
> Yasuo Ohgaki
> yohgaki@ohgaki.net
>

I think it would be nice also keeping the hash replacement on the table,
otherwise we will just continue the current trend (to fix/work around the
immediate problem, only to resurface later in a different form).

--=20
Ferenc Kov=C3=A1cs
@Tyr43l - http://tyrael.hu

--089e013d1a6434c6aa050aec3844--