| |||||||||||||
A hash-based DOS attack on BtrfsA hash-based DOS attack on BtrfsPosted Dec 14, 2012 12:35 UTC (Fri) by masoncl (subscriber, #47138)In reply to: A hash-based DOS attack on Btrfs by davidescott Parent article: A hash-based DoS attack on Btrfs
We can easily add a different hash to the directory format. There are 64 bits available for the hash, although you're limited to 32 bits on 32 bit userland thanks to the readdir/seekdir/telldir interfaces.
Salting etc are also more than possible. I personally don't think the hash makes the shared directories in any way secure, but I've been wrong many times before ;)
(Log in to post comments)
A hash-based DOS attack on Btrfs Posted Dec 14, 2012 16:09 UTC (Fri) by cesarb (subscriber, #6266) [Link]
I believe the ext* family uses salting (the "Directory Hash Seed" field you can see in dumpe2fs). This should be enough to make the hash unpredictable as long as the attacker does not know the seed, and the only way to know the seed should be having raw block access to the partition and reading the superblock.
But if the hash output is visible via telldir, the attacker can still find out the salt unless you are using strong crypto, which would not be very good for performance. I think the hash output is not visible via telldir on the ext* family.
You could play games like having a per-directory randomly chosen salt, but if you are getting to that point IMHO it is better to work on making the algorithms robust against degenerate edge cases.
A hash-based DOS attack on Btrfs Posted Dec 14, 2012 17:01 UTC (Fri) by davidescott (guest, #58580) [Link]
It might not be a bad idea to salt, even if the salt can be determined through telldir. As you pointed out anyone running local code has much more obvious methods of attack (touch "filename" instead of touch "hash_collision_with_filename"), and a per directory salt would prevent most of the remote attacks suggested in the comments.
Hopefully nobody exports a "tell/read/seekdir" interface over php.
A hash-based DOS attack on Btrfs Posted Dec 14, 2012 17:35 UTC (Fri) by dakas (guest, #88146) [Link]
Uh, with a CRC salting a whole directory with the same salt will cause exactly the same collisions as without salt. The salt will just cause the final CRC to be XORed with a constant.
A CRC is not a cryptographic hash. Salting is useless, and identical prefixes have identical impact on the result.
A hash-based DOS attack on Btrfs Posted Dec 14, 2012 21:56 UTC (Fri) by masoncl (subscriber, #47138) [Link]
I should have made it clear that salting only makes a difference if we add an optional second hash.
|
|||||||||||||