STINNER Victor <[email protected]> added the comment:
"Given that a user has an application with an oracle function that returns the
hash of a unicode string, an attacker can probe tenth of thousand one and two
character unicode strings. That should give him/her enough data to calculate
both seeds. hash("") already gives away lots of infomration about the seeds,
too."
Sorry, but I don't see how you compute the secret using these data.
You are right, hash("\0") gives some information about the secret. With my
patch, hash("\0")^1 gives: ((prefix * 1000003) & HASH_MASK) ^ suffix.
(hash("\0")^1) ^ (hash("\0\0")^2) gives ((prefix * 1000003) & HASH_MASK) ^
((prefix * 1000003**2) & HASH_MASK).
----------
_______________________________________
Python tracker <[email protected]>
<http://bugs.python.org/issue13703>
_______________________________________
_______________________________________________
Python-bugs-list mailing list
Unsubscribe:
http://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com
