[Python-Dev] Hash collision security issue (now public)

[Christian Heimes]

Am 01.01.2012 17:54, schrieb Antoine Pitrou:
> I don't understand. FNV-1 multiplies the current running result with a
> prime and then xors it with the following byte. This is also what we do.
> (I'm assuming 1000003 is prime)

There must be a major difference somewhere inside the algorithm. The
talk at the CCC conference in Berlin mentions that Ruby 1.9 is not
vulnerable to meet-in-the-middle attacks and Ruby 1.9 uses FNV. The C
code of FNV is more complex than our code, too.

Christian