| |||||||||||||
A hash-based DOS attack on BtrfsA hash-based DOS attack on BtrfsPosted Dec 14, 2012 17:01 UTC (Fri) by davidescott (guest, #58580)In reply to: A hash-based DOS attack on Btrfs by masoncl Parent article: A hash-based DoS attack on Btrfs
It might not be a bad idea to salt, even if the salt can be determined through telldir. As you pointed out anyone running local code has much more obvious methods of attack (touch "filename" instead of touch "hash_collision_with_filename"), and a per directory salt would prevent most of the remote attacks suggested in the comments.
Hopefully nobody exports a "tell/read/seekdir" interface over php.
(Log in to post comments)
A hash-based DOS attack on Btrfs Posted Dec 14, 2012 17:35 UTC (Fri) by dakas (guest, #88146) [Link]
Uh, with a CRC salting a whole directory with the same salt will cause exactly the same collisions as without salt. The salt will just cause the final CRC to be XORed with a constant.
A CRC is not a cryptographic hash. Salting is useless, and identical prefixes have identical impact on the result.
A hash-based DOS attack on Btrfs Posted Dec 14, 2012 21:56 UTC (Fri) by masoncl (subscriber, #47138) [Link]
I should have made it clear that salting only makes a difference if we add an optional second hash.
|
|||||||||||||