netdev - Re: Extensible hashing and RCU

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <f2b55d220702201203m2f188253h7f68d5be9a457f4a@mail.gmail.com>
Date:	Tue, 20 Feb 2007 12:03:04 -0800
From:	"Michael K. Edwards" <medwards.linux@...il.com>
To:	"Evgeniy Polyakov" <johnpol@....mipt.ru>
Cc:	"Eric Dumazet" <dada1@...mosbay.com>,
	"David Miller" <davem@...emloft.net>, akepner@....com,
	linux@...izon.com, netdev@...r.kernel.org, bcrl@...ck.org
Subject: Re: Extensible hashing and RCU

On 2/20/07, Evgeniy Polyakov <johnpol@....mipt.ru> wrote:
> How I like personal insults - it is always fun to read about myself from
> people who never knew me :)

On this occasion, I did not set out to insult you.  I set out to
suggest an explanation for why cooler and grayer heads than mine are
not falling over themselves to merge your designs into the mainline
kernel.  Did I succeed?

> I just shown a problem in jenkins hash - it is not how to find a
> differnet input for the same output - it is a _law_ which allows to
> break a hash. You will add some constant, and that law will be turned
> into something different (getting into account what was written, it will
> end up with the same law).

Correct.  That's called a "weak hash", and Jenkins is known to be a
thoroughly weak hash.  That's why you never, ever use it without a
salt, and you don't let an attacker inspect the hash output either.

> Using jenkins hash is equal to the situation, when part of you hash
> chains will be 5 times longer than median square value, with XOR one
> there is no such distribution.

Show us the numbers.  Salt properly this time to reduce the artifacts
that come of applying a weak hash to a poor PRNG, and histogram your
results.  If you don't get a Poisson distribution you probably don't
know how to use gnuplot either.  :-)

> Added somthing into permutations will not endup in different
> distribution, since it is permutations which are broken, not its result
> (which can be xored with something).

I can't parse this.  Care to try again?

Cheers,
- Michael
-
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html