Beefy Boxes and Bandwidth Generously Provided by pair Networks
more useful options
 
PerlMonks  

Re^20: Our perl/xs/c app is 30% slower with 64bit 5.24.0, than with 32bit 5.8.9. Why?

by dave_the_m (Prior)
on Dec 24, 2016 at 00:24 UTC ( #1178451=note: print w/replies, xml ) Need Help??


in reply to Re^19: Our perl/xs/c app is 30% slower with 64bit 5.24.0, than with 32bit 5.8.9. Why?
in thread Our perl/xs/c app is 30% slower with 64bit 5.24.0, than with 32bit 5.8.9. Why?

Doesn't that render all the preceding discussion -- in this thread and elsewhere -- about being able to discover the seed, completely redundant?
No.

With 5.8.1 we assumed we'd fixed algorithmic complexity attacks. When it all blew up again in 2013, we looked on smugly as Python, Ruby et al scrambled to do the same stuff we'd already done years before. Then we looked more closely and realised that our 5.8.1 fix wasn't as good as it could be. Then we noticed that in addition, the 5.8.1 fix had introduced the hash bucket doubling bug. These issues were fixed. Then someone noticed that unsorted hash keys leaked the hash seed (around 3 bits per key IIRC). Proof of Concept code was written which demonstrated that the whole hash seed could be recovered based on receiving a small number of unsorted (and non-special) keys.

This meant that even with a good hash function and a random seed, it might be possible to attack. So we we added bucket perturbation too which seems to have stopped the seed leak.

(This is based on my recollections from the long discussion from 3/4 years ago).

would you share them with me privately
I'd prefer not to right now,

Dave.

  • Comment on Re^20: Our perl/xs/c app is 30% slower with 64bit 5.24.0, than with 32bit 5.8.9. Why?

Log In?
Username:
Password:

What's my password?
Create A New User
Node Status?
node history
Node Type: note [id://1178451]
help
Chatterbox?
and all is quiet...

How do I use this? | Other CB clients
Other Users?
Others taking refuge in the Monastery: (6)
As of 2017-11-21 22:31 GMT
Sections?
Information?
Find Nodes?
Leftovers?
    Voting Booth?
    In order to be able to say "I know Perl", you must have:













    Results (312 votes). Check out past polls.

    Notices?