Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:79915
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.192.51 as permitted sender)
MIME-Version: 1.0
In-Reply-To: <CAGa2bXZDFe=UVeiFjAXgB+9zFODJT_pU2jQfqnuYDsxDnwpu8w@mail.gmail.com>
References: <CAPKwhwsNbjeiMjb=yxNOVAXTBGWpT+Cm6X5Q1peT=_TOLGThxg@mail.gmail.com>
	<CAEZPtU7UfK7CApn=86q-G3WS1uKpiuVqLy7fdwv1vg5v0kDt7Q@mail.gmail.com>
	<CAGa2bXZchck1uNvW=4HVRF7Y4km4deqZ9C0bCU4JzVQJnmOjGQ@mail.gmail.com>
	<09B14273-C621-4AB9-9129-A149A9480A03@ajf.me>
	<CAEZPtU7MOcgmSt1B-4fKK-PNVfk2567PV8CJ==0ab_M105EAdw@mail.gmail.com>
	<CAGa2bXZDFe=UVeiFjAXgB+9zFODJT_pU2jQfqnuYDsxDnwpu8w@mail.gmail.com>
Date: Wed, 24 Dec 2014 20:29:54 +1100
Message-ID: <CAEZPtU4bi4amkVDV3mhUbJ+BzAP7wvgO9A_yL_VXLT_bZCoa7A@mail.gmail.com>
To: Yasuo Ohgaki <yohgaki@ohgaki.net>
Cc: Andrea Faulds <ajf@ajf.me>, PHP internals <internals@lists.php.net>, 
	Scott Arciszewski <kobrasrealm@gmail.com>
Content-Type: text/plain; charset=UTF-8
Subject: Re: [PHP-DEV] JSON HASHDOS
From: pierre.php@gmail.com (Pierre Joye)

hi,

On Wed, Dec 24, 2014 at 7:37 PM, Yasuo Ohgaki <yohgaki@ohgaki.net> wrote:
> Hi Pierre,
>
> On Wed, Dec 24, 2014 at 4:23 PM, Pierre Joye <pierre.php@gmail.com> wrote:
>>
>> Please keep in mind that this problem is:
>>
>> . not json specific
>> . not specific at runtime but could also happen before a script get the
>> hand
>>
>> A randomized hash only postpone the issue but won't solve it.
>>
>> I fear that a fix is way more work that what we may think. A discussion is
>> going on security, let hope to get something in a reasonable time. I also
>> wonder what we could provide right now to at least prevent script kiddies
>> attacks during this holiday season..
>
> I only read Zend code on occasion, so it might not be feasible.
>
> Anyway, when collision happens, Engine detects collision.
> Limited number of collision should happen under normal circumstances.
> Simply limiting number of collisions for a specific hash bucket would
> prevent DoS. The limit may be INI setting, so that users may set higher
> limit when they need.
>
> We may use more secure hash like half MD4 or CityHash (I'm not sure if
> CityHash is secure enough, though), but it would be much slower than now.
>
> Limiting number of collision would be the best solution. We never worry
> about
> intensional collision attack again.

I do not see how it solves the problem. It only reduces it, slightly.
Having a couple of medium instances generating crafted requests will
just have the same effect. So far the more realistic suggestions are
about having collision safe implementation, not implementation with
limited collisions.

> P.S. Did we decide to have 64 bit array keys? 64 bit array key is much more
> stronger against collisions.

I would not say "much stronger", slightly stronger, but as long as the
same implementation is used, it does not really solve anything on this
area.


-- 
Pierre

@pierrejoye | http://www.libgd.org