Subject: RE: [hackers-il] Re: To Hash or not to Hash [was Re: \"On Lisp\" now available ]

From: Ofir Carny <[email-masked]>
Date: Thu, 7 Feb 2002 12:09:32 +0200

As I said, it is only good for specific applications, obviously, you can't
change a hash function without rebuilding an existing table, however in some
applications it is enough to prevent a malicious attempt to 'break' your
function.

I didn't refer to the chain, however (unrelated), you can use a second
function to use the table for the chain, avoiding memory allocation for
collisions in a constant sized table.
-----Original Message-----
From: Nadav Har'El [mailto:[email-masked]]
Sent: Thursday, February 07, 2002 11:39 AM
To: [email-masked]
Subject: Re: [hackers-il] Re: To Hash or not to Hash [was Re: \"On
Lisp\" now available ]

On Thu, Feb 07, 2002, Ofir Carny wrote about "RE: [hackers-il] Re: To Hash
or not to Hash [was Re: \"On Lisp\" now available ]":
> As far as I remember, for some applications, you can also use a random
hash
> in order to avoid being tricked.
> 
> This means a hash function which is not constant (or depends on another
not
> constant parameter).

What do you mean? If you place an entry somewhere in the table, and next
time you go looking for it your "random hash" lands you somewhere else, how
will you find that existing entry? Maybe you mean ordering entries in one
hash chain in a random order? But I can't see what that would get you -
hash chains are supposed to be short anyway.

-- 
Nadav Har'El                        |    Thursday, Feb  7 2002, 25 Shevat
5762
[email-masked]
|-----------------------------------------
Phone: +972-53-245868, ICQ 13349191 |The world is coming to an end ... SAVE
http://nadav.harel.org.il           |YOUR BUFFERS!!!

To unsubscribe from this group, send an email to:
[email-masked]

Your use of Yahoo! Groups is subject to http://docs.yahoo.com/info/terms/ 

**********************************************************************
This email and any files transmitted were checked by 
Port Authority Enterprise for unathorized content.
**********************************************************************

---

From: "Nadav Har'El" <[email-masked]>
Date: Thu, 7 Feb 2002 12:24:08 +0200

> applications it is enough to prevent a malicious attempt to 'break' your

Oh, I see - you meant choosing, once, a *hash function* at random, but then
use the same hash function all the time? Ok.

-- 
Nadav Har'El                        |    Thursday, Feb  7 2002, 25 Shevat 5762
[email-masked]             |-----------------------------------------
Phone: +972-53-245868, ICQ 13349191 |Unlike Microsoft, a restaurant will give
http://nadav.harel.org.il           |me food for free if I find a bug in it!

---

From: Shlomi Fish <[email-masked]>
Date: Thu, 7 Feb 2002 13:05:35 +0200 (IST)

> use the same hash function all the time? Ok.

There is a methodology to construct a random hash function out of a
universal set of hash functions. This is called Universal Hashing, and I
studied about it in my DS and Algorithms course. An example for it, would
be to randomize an arbitrary string to prepend (or append) to the data
before it is MD5'ed. That way, even if the user deliberately creates
different strings whose first 32-bit MD5 bits are the same, he'll still
won't be able to out-smart the hash, because the prefix will make their
salt values completely different.

Of course, letting the user know what the prefix is will render it
useless. So it's kind of like a "security by obscurity" methodolgy.

Regards,

----------------------------------------------------------------------
Shlomi Fish        [email-masked]
Home Page:         http://t2.technion.ac.il/~shlomif/
Home E-mail:       [email-masked]

"Let's suppose you have a table with 2^n cups..."
"Wait a second - is n a natural number?"

---

From: Arik Baratz <[email-masked]>
Date: Thu, 7 Feb 2002 19:12:06 +0000 (GMT)

vailable ]?=
MIME-Version: 1.0
Content-Type: text/plain; charset=iso-8859-1

Perhaps all you want is to distribute a set of values in a uniform fashion.

-- Arik

On 07.02.2002 at 12:09:56, Ofir Carny <[email-masked]> wrote:

> As I said, it is only good for specific applications, obviously, you can\'t
> applications it is enough to prevent a malicious attempt to \'break\' your
> function.
> 
> I didn\'t refer to the chain, however (unrelated), you can use a second
> From: Nadav Har\'El [mailto:[email-masked]]
> Subject: Re: [hackers-il] Re: To Hash or not to Hash [was Re: \\\"On
> Lisp\\\" now available ]
> 
> 
> On Thu, Feb 07, 2002, Ofir Carny wrote about \"RE: [hackers-il] Re: To Hash
> or not to Hash [was Re: \\\"On Lisp\\\" now available ]\":
> time you go looking for it your \"random hash\" lands you somewhere else,
how
> hash chain in a random order? But I can\'t see what that would get you -
> Nadav Har\'El                        |    Thursday, Feb  7 2002, 25 Shevat
> 5762
> [email-masked]

Arik Baratz
System Engineer
[email-masked]

Office:
4 Hamelacha St.
Raa&#8217;nana 43661
ISRAEL

Tel:    +972 (9) 743-9250 ext. 214
Fax:   +972 (9) 743-9251
Cell:  +972 (52) 354 959
eFax: +1 (978) 926-8913
ICQ:  210 8214

Privileged and / or confidential Information may be contained in this electronic
mail message. 

You may not copy or deliver this message to anyone without my consent.

If you are not the addressee indicated in this message, or you feel that this
message is not intended for you, Please destroy this message and kindly notify
the sender by replying to this electronic mail.

Please advise immediately if you or your employer do not agree to the use of
Internet email for messages of this kind.

Opinions, conclusions and other information in this message that do not relate
to the official business of Vidius shall be understood as neither given nor
endorsed by it.