in reply to Randomizing Hash Implementation?
The basis of the attack is that while on average adding n entries to a hash is O(n), if you encounter the wrong data set it is O(n*n). If you know the hashing algorithm that someone is using you may therefore be able to feed them data that will cause them to use up a surprising amount of CPU time. This makes denial of service attacks easier.
But now there is no way to predict exactly what hashing algorithm you'll face, making it impossible to construct a dataset that reliably causes Perl to run into this problem.
|
|---|