in reply to Re: Re: Re: Hash Clash on purpose
in thread Hash Clash on purpose
It is possible to use shorter strings. There is a bug in how Perl puts hashes in buckets that makes pathological hashes more likely. The paper generated strings that all have the same hash value. It is much easier to find strings that all go in the same hash bucket. tye wrote a patch that fixes this bug and recently got it accepted.
tilly wrote a generator that uses the bug to quickly find strings that produce pathological hashes. About 1/8 of all strings fit the criteria. Using simple alphabetic strings, I can get 60000 strings encoded 300000 bytes that all go in the same bucket. Inserting all of those into a hash takes 10 minutes for direct insert and much longer for CGI parsing.
|
|---|