Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Tue, 5 May 2015 08:24:42 +0000
From: mancha <>
Subject: Re: PHP and some == wonkiness

On Tue, May 05, 2015 at 09:44:00AM +0200, Florian Weimer wrote:
> On 05/05/2015 09:26 AM, mancha wrote:
> > Taking sha1 as our reference hash and "==" as our equivalence relation:
> > 
> > All [a-f][0-9a-f]{39} are in equivalence class A.
> > 
> > All 42[a-f][0-9a-f]{37} are in equivalence class B.
> > 
> > Note: those regexes aren't representative of the full equivalence
> > classes because prepending 0s doesn't alter the value (i.e.
> > 0[a-f][0-9a-f]{38} is in equivalence class "A" as well..
> I cannot reproduce this.  Or you use “equivalence class” in a
> non-standard way.
> -- Florian Weimer / Red Hat Product Security

I was using "equivalence class" in a standard way but mis-understood
PHP's casting rules when comparing strings so never mind that comment.

To raise the SNR back up, I agree with your assessment if we account for
prepended 0s. So out of the 16^40 total hashes, I believe
10^38+10^37+...+10^1 of them will evaluate to float(0). A bit higher
than your estimate (which only considered 10^38 of them). Same order of
magnitude though.


Content of type "application/pgp-signature" skipped

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.