[issue13703] Hash collision security issue
Antoine Pitrou
report at bugs.python.org
Wed Jan 11 15:45:35 CET 2012
Antoine Pitrou <pitrou at free.fr> added the comment:
> OTOH, the collision counting patch is very simple, doesn't have
> the performance issues and provides real protection against the
> attack.
I don't know about real protection: you can still slow down dict
construction by 1000x (the number of allowed collisions per lookup),
which can be enough combined with a brute-force DOS.
Also, how about false positives? Having legitimate programs break
because of legitimate data would be a disaster.
----------
_______________________________________
Python tracker <report at bugs.python.org>
<http://bugs.python.org/issue13703>
_______________________________________
More information about the Python-bugs-list
mailing list