Re: Randomize hash-function in php
| From: | Tjerk Meesters | Date: | Sun, 18 Mar 2012 07:05:42 +0000 |
| Subject: | Re: Randomize hash-function in php | ||
| References: | 1 2 3 4 5 6 | Groups: | php.internals |
| Request: | Send a blank email to internals+get-58995@lists.php.net to get a copy of this message | ||
On 18 Mar, 2012, at 2:32 PM, Xinchen Hui <laruence@gmail.com> wrote:
>> What if php uses salts for specific hashes only, such as GPC (or all
>> hashes whose lifetime is limited to the current reuqest), and use a
>> zero-value salt for all others?
> definitely no，thinking of pre-calculated hash.
Pre-calculated hash of what? You mean binary serialisation?
> Or Ajax which use
> json_decode parse input json.
That would be considered a request lifetime hash and therefore could be salted.
>
> IMO, this Make no sense but mess things up.
We all have opinions. If a clear distinction between vulnerable and non vulnerable data can be
reliably made, in my limited knowledge of the whole ecosystem I genuinely think this has a shot :)