Researcher reframes findings as bugs rather than vulnerabilities
4 Sep 20 6:22 PM · 3d ago · 1 comment · 1 source · development 4 of 4
Ahle clarifies that the collisions should be viewed as bugs in implementation rather than fundamental vulnerabilities, since hash functions are designed to prevent seed-independent collisions through their secret key mechanism. He hopes the comparison with provably-safe hashes will encourage adoption of more robust alternatives.
“I think it's fair to think of these findings more as "bugs" than "vulnerabilities". Ultimately a hash isn't supposed to have seed-indpendent collisions. That's the whole point of the secret key.”
thomasahleThomas Ahle Researcher/blog authorClaude Fable AI analysis tool
The whole story postscomments the bright band is this development · numbered dots are the others · click one to jump
What people said 4 voices · verbatim
-
I have come around to a strong belief that the correct design direction for hash tables is perhaps a bit surprising: require an ordering in addition to a hash, and fall back to a b-tree when excessive collisions occur. Then use the weakest, cheapest, fastest hash you can get away with. And we should have an `UnsafeHashMap` or some such which omits…
-
Yes, I think it's fair to think of these findings more as "bugs" than "vulnerabilities". Ultimately a hash isn't supposed to have seed-indpendent collisions. That's the whole point of the secret key. It can be very hard to know if something that's inherently random is buggy or working as intended. I hope that showing the bugs found, vs the hashes…
-
What price level is too costly? But also, hashing is used in more data structures than hash tables. If we're aiming for almost-universality like Ahle does, we have a few very reasonable classic solutions for small GPR-sized values https://arxiv.org/abs/1504.06804 (and universality with independent random keys composes fine on…
-
Do you mean a content-based ordering, or simply something like insertion order?
All 4 developments of Claude AI finds seed-independent collisions in popular hash… →
RedditHacker NewsLobsters