<?xml version="1.0" encoding="windows-1252"?>
<node id="1007030" title="Re^14: Hash order randomization is coming, are you ready?" created="2012-12-04 03:24:11" updated="2012-12-04 03:24:11">
<type id="11">
note</type>
<author id="171588">
BrowserUk</author>
<data>
<field name="doctext">
&lt;blockquote&gt;&lt;i&gt;
but not reasoning for changing the hash algorithm itself -- Sure it is. A strong hash function is harder to attack.
&lt;/i&gt;&lt;/blockquote&gt;

&lt;p&gt;With respect, that is garbage. The way the original algorithmic complexity attack was constructed, was to simply hash a mess of random strings of a given length and see which one's hashed to the same value. As soon as anyone gets their hands on the release that contains a different hashing function, the "strength of the hashing function" -- a totally meaningless measure in this context -- is completely negated. 

&lt;p&gt;Only the reliability of the randomised seed provides any protection whatsoever.

&lt;blockquote&gt;&lt;i&gt;
why you would do it on a hash-by-hash basis rather than a per-process basis. -- Concerns over information exposure of key order to an attacker.
&lt;/i&gt;&lt;/blockquote&gt;

&lt;p&gt;Unfounded (and illogical) concerns. If the "attacker" has sufficient access to be able to determine the per-process seeding, they have sufficient access to have far simpler and more effective attack vectors.

&lt;p&gt;Like fitting an anchor to a car or an air brake to a submarine, the extra prophylactic serves no purpose.

&lt;blockquote&gt;&lt;i&gt;
If there is any reluctance it is purely that of me wanting to avoid a long dialog repeating what has already been said elsewhere. 
&lt;/i&gt;&lt;/blockquote&gt;

&lt;p&gt;I see. So we users of this modification shouldn't be concerning our simple selves with the difficult details of this change huh?

&lt;p&gt;Would copy/pasting taking so much timeand effort? Even a link to the existing discussion would have sufficed.


&lt;p&gt;But fear not, I'm not asking you to argue your case here. I've already heard enough to realise that this is tinkering for it's own sake, rather than justifiable development.


&lt;div class="pmsig"&gt;&lt;div class="pmsig-171588"&gt;
&lt;hr /&gt;
&lt;font size=1 &gt;
&lt;div&gt;With the rise and rise of 'Social' network sites: 'Computers are making people easier to use everyday'&lt;/div&gt;
&lt;div&gt;Examine what is said, not who speaks -- Silence betokens consent -- Love the truth but pardon error.&lt;/div&gt;
&lt;div&gt;"Science is about questioning the status quo. Questioning authority". &lt;/div&gt;
&lt;div&gt;In the absence of evidence, opinion is indistinguishable from prejudice.
&lt;p align=right&gt; [http://thebottomline.cpaaustralia.com.au/|RIP Neil Armstrong]&lt;/p&gt;&lt;/div&gt;
&lt;/font&gt;

&lt;/div&gt;&lt;/div&gt;</field>
<field name="root_node">
1005122</field>
<field name="parent_node">
1007024</field>
</data>
</node>
