Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:96038
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain thefsb.org designates 173.203.187.123 as permitted sender)
To: Scott Arciszewski <scott@paragonie.com>,
 PHP Internals <internals@lists.php.net>
References: <CAKws9z2EWkNNhM7tOMh-_pQ3iLjVj7hbXTB1Hh3a19utPzj-9A@mail.gmail.com>
Message-ID: <27cb79b8-2501-289c-f9f3-091bacca7874@thefsb.org>
Date: Tue, 20 Sep 2016 10:22:49 -0400
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.10; rv:45.0)
 Gecko/20100101 Thunderbird/45.2.0
MIME-Version: 1.0
In-Reply-To: <CAKws9z2EWkNNhM7tOMh-_pQ3iLjVj7hbXTB1Hh3a19utPzj-9A@mail.gmail.com>
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Transfer-Encoding: 7bit
Subject: Re: HashDoS
From: fsb@thefsb.org (Tom Worster)

On 9/15/16 2:48 PM, Scott Arciszewski wrote:

> Would the Internals team be open to discussing mitigating HashDoS in a
> future version of PHP? i.e. everywhere, even for json_decode() and friends,
> by fixing the problem rather than capping the maximum number of input
> parameters and hoping it's good enough.
>
> I'd propose SipHash (and/or a derivative): https://www.131002.net/siphash/
>
> (Look at all the other languages that already adopted SipHash.)

I briefly looked through the "Users" list and didn't find anything 
equivalent to using it as PHP's internal base hash.

Python and Rust have an implementation available to users. Ruby is using 
it internally but I think it's focused on JSON.

There's some good info[1] on the situation in Perl 5. While SipHash is 
available it requires a non-default compile-time option.

Correct me if I'm not reading the situation right.

Tom

[1] 
http://news.perlfoundation.org/2012/12/improving-perl-5-grant-report-11.html