Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Sat, 04 Jun 2016 03:07:56 -0400
From: Daniel Micay <danielmicay@...il.com>
To: oss-security@...ts.openwall.com
Subject: Re: Re: expat hash collision fix too predictable?

It's quite questionable for libraries to be calling thread-unsafe
functions like rand or strtok at all. AFAIK, expat is supposed to be
thread safe and is used in many multi-threaded applications.

A proper hash DoS fix is using a CSPRNG to generate keys for a keyed
hash with meaningful security properties, like SipHash. It's usually
done very poorly, and the quality of the RNG doesn't matter much if key
independent collisions can be generated for the hash function anyway.
[ CONTENT OF TYPE application/pgp-signature SKIPPED ]

Powered by blists - more mailing lists

Your e-mail address:

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Powered by Openwall GNU/*/Linux - Powered by OpenVZ