Re: Randomize hash-function in php
| From: | Xinchen Hui | Date: | Sun, 18 Mar 2012 07:17:58 +0000 |
| Subject: | Re: Randomize hash-function in php | ||
| References: | 1 2 3 4 5 6 7 | Groups: | php.internals |
| Request: | Send a blank email to internals+get-58996@lists.php.net to get a copy of this message | ||
Sent from my iPhone
在 2012-3-18，15:05，Tjerk Meesters <tjerk.meesters@gmail.com> 写道：
> On 18 Mar, 2012, at 2:32 PM, Xinchen Hui <laruence@gmail.com> wrote:
>
>>> What if php uses salts for specific hashes only, such as GPC (or all
>>> hashes whose lifetime is limited to the current reuqest), and use a
>>> zero-value salt for all others?
>> definitely no，thinking of pre-calculated hash.
>
> Pre-calculated hash of what? You mean binary serialisation?
>
>> Or Ajax which use
>> json_decode parse input json.
>
> That would be considered a request lifetime hash and therefore could be salted.
>
>>
>> IMO, this Make no sense but mess things up.
>
> We all have opinions. If a clear distinction between vulnerable and non vulnerable data can be
> reliably made, in my limited knowledge of the whole ecosystem I genuinely think this has a shot :)
>
Ha, sorry for my rude words, I am not meaning you， but the point self;)
And it's also why I am not usually saying words at internal@ , my poor
English :)