Description

assignee = 'https://github.com/rhettinger'
closed_at = <Date 2017-12-04.20:03:38.678>
created_at = <Date 2017-11-30.05:39:15.418>
labels = ['type-feature']
title = 'Add hash auto-randomization'
updated_at = <Date 2017-12-04.22:22:50.769>
user = 'https://bugs.python.org/bjarvis'

activity = <Date 2017-12-04.22:22:50.769>
actor = 'vstinner'
assignee = 'rhettinger'
closed = True
closed_date = <Date 2017-12-04.20:03:38.678>
closer = 'rhettinger'
components = []
creation = <Date 2017-11-30.05:39:15.418>
creator = 'bjarvis'
dependencies = []
files = ['47305']
hgrepos = []
issue_num = 32175
keywords = ['patch']
message_count = 6.0
messages = ['307278', '307295', '307314', '307590', '307593', '307601']
nosy_count = 5.0
nosy_names = ['rhettinger', 'pitrou', 'vstinner', 'christian.heimes', 'bjarvis']
pr_nums = []
priority = 'normal'
resolution = 'rejected'
stage = 'resolved'
status = 'closed'
superseder = None
type = 'enhancement'
url = 'https://bugs.python.org/issue32175'
versions = ['Python 2.7']

Activity

1. bjarvis commented on Nov 30, 2017

   

   bjarvismannequin

   on Nov 30, 2017

   MannequinAuthor

   More actions

   Hash auto-randomization is a mechanism to detect when a collision attack is underway and switch to a randomized keying scheme at that point.

   This patch is for the 2.7 branch, where hash randomization is not on by default.

   Using collided strings from https://github.com/Storyyeller/fnv-collider/tree/master/collided_strings, 10 "attacks" of roughly 50,000 collided strings were launched against this. The unmodified Python had a median insert time of roughly 4.32 seconds and a median retrieve time of roughly 4.40 seconds. With the auto-randomized version of Python, the median insert time was roughly 3.99 seconds and median retrieve time was roughly 3.57 seconds. This is a 7.7% and 18.9% savings, respectively.
2. bjarvis

   added

   type-featureA feature request or enhancementA feature request or enhancement

   on Nov 30, 2017
3. tiran commented on Nov 30, 2017

   

   tiran

   on Nov 30, 2017

   Member

   More actions

   Raymond, dicts are your area of expertise.

   I'm -0 on the patch. The check is going to slow down dicts and it's really easy to enable randomization with an env var or command line argument.
4. tiran

   assigned

   rhettinger

   on Nov 30, 2017
5. vstinner commented on Nov 30, 2017

   

   vstinner

   on Nov 30, 2017

   Member

   More actions

   It was decided to leave the hash randomization disabled by default for backward compatibility. It's a deliberate choice.

   I don't think that we need to go further for Python 2.7. I never considered this denial of service attach as major, there are many other ways to trigger a DoS, and fixing the dict type is not the right way to prevent this class of attacks.

   HTTP clients and frameworks like http.client and Django implemented other countermeasures like limiting the number of HTTP headers.

   The problem was correctly fixed in Python 3: randomization enabled by default since Python 3.3, and Python 3.4 now uses SipHash which better hides the hash secret.

   More info at:

   • http://python-security.readthedocs.io/vuln/cve-2012-1150_hash_dos.html
   • http://python-security.readthedocs.io/vuln/cve-2013-7040_hash_not_properly_randomized.html

   Reacted by Gregory P. Smith
6. pitrou commented on Dec 4, 2017

   

   pitrou

   on Dec 4, 2017

   Member

   More actions

   Agreed this is not desirable at this point. Let's leave 2.7 like it is.
7. rhettinger commented on Dec 4, 2017

   

   rhettinger

   on Dec 4, 2017

   Contributor

   More actions

   Marking as closed for the reasons listed by the other respondents.
8. rhettinger

   closed this as completedon Dec 4, 2017
9. vstinner commented on Dec 4, 2017

   

   vstinner

   on Dec 4, 2017

   Member

   More actions

   By the way, for a few other reasons, Python 3 is more secure than Python 2.7. If you care of security, please upgrade!
10. ezio-melotti

    transferred this issue fromon Apr 10, 2022

Issue actions