Re: Function Points

From	"Rod Pemberton" <do_not_have@notemailnot.cmm>
Newsgroups	comp.lang.forth
Subject	Re: Function Points
Date	2012-08-31 18:56 -0400
Organization	Aioe.org NNTP Server
Message-ID	<k1rfal$jji$1@speranza.aioe.org> (permalink)
References	(11 earlier) <2012Aug30.160847@mips.complang.tuwien.ac.at> <7xmx1cmg1t.fsf@ruckus.brouhaha.com> <2250796.QNINORRiYk@sunwukong.fritz.box> <k1phj0$lr8$1@speranza.aioe.org> <b-mdnS3hM6567d3NnZ2dnUVZ8midnZ2d@supernews.com>

Show all headers | View raw

"Andrew Haley" <andrew29@littlepinkcloud.invalid> wrote in message
news:b-mdnS3hM6567d3NnZ2dnUVZ8midnZ2d@supernews.com...
> Rod Pemberton <do_not_have@notemailnot.cmm> wrote:
> > "Bernd Paysan" <bernd.paysan@gmx.de> wrote in message
> > news:2250796.QNINORRiYk@sunwukong.fritz.box...

[...]

> >> But C's main problem is one fundamental mistake: buffers are passed
> >> around as pointers, without length.
> >
> > If you knew anything about C, you'd know that the length of a buffer
> > is always known.  It's either in the declaration of the buffer, or
> > was needed to allocate the buffer dynamicly, or is available with
> > sizeof() or strlen() etc.  Whether or not the length is available
> > when needed is a programmer implementation issue.
>
> Well, yes.  It's the "programmer implementation issue" that Bernd is
> talking about.  It's the fact that if someone passes you an int[] you
> can't say "How big is this?"  Yes, you can insist that they also pass
> you the size, but that doesn't change the fact that the language
> doesn't.
>

So?  Why should the language?  Forth doesn't do a bunch of stuff that C does
for the user.  Forth requires the user to do so: stack mainenance,
allocation, etc.  So, how is Forth any better than C?  IMO, this is a "black
pot calling the black kettle 'black'" issue.

> >> The other way to deal with that problem is to have a unique hash
> >> function, which the attacker can't create hash collisions for (for
> >> being "unique", something quite simple is completely sufficient:
> >> xor all strings with the same secret).
> >
> > There is no guarantee that for two non-XOR'd strings which are hash
> > collisions that their two XOR'd strings won't be hash collisions
> > also.  If the hash function has low collisions, then it's unlikely
> > the XOR'd strings will collide, but that's also true for the
> > non-XOR'd strings.
>
> You're missing the point.  The idea of the unique hash function is not
> to make collisions impossible but to make them unpredictable: the
> scenario is one where the attacker knows the hash function and
> deliberately creates collisions.
>

What value does that have?

After working through the conlusion further below, I can only see XOR-ing of
being of very minimal use in preventing some type of pre-computed dictionary
attacks involving hash collisions.  That's if the use of XOR-ing is kept
secret, is indeterminable, and the attacker isn't intelligent enough to
determine what is being done.  If the attacker knows the hash function and
they aren't obtaining the desired collisions, they know something has
changed.  Since the XOR secret is used on all inputs, if the attacker has
the hash values for the host under attack, he only need try numerous secret
strings until the hash values begin to match.  So, even when using a secret
XOR, one must keep the hash values secret too.  IIRC, *nix style hosts don't
or (didn't) keep the resulting hash lists secret for it's password file.

But, there is an even simpler method than XOR-ing to do that.  There is no
need to XOR.  Use a "salt":
http://en.wikipedia.org/wiki/Salt_(cryptography)

How I came to the conclusion that XOR-ing is of minimal use:

There is no need to make collisions "unpredictable" if collisions aren't a
problem in some manner.  I.e., making collisions "unpredictable" means there
is some problem with collisions.  The best solution in that case is to
reduce the input set and use a hash with a lower frequency or probability of
collisions, i.e., a better hash and/or a larger sized hash value.

If the attacker knows which hash function is being used, then the attacker
knows the entire set of input strings too.  Shifting the input set via XOR
doesn't eliminate or reduce the overall frequency or probability of
collisions generated by the hash.  So, the probability that the shifted set
collides is the same as the unshifted set.  If collisions are occuring at
the same rate and those collisions are causing some problem, all the
attacker has to do is run the entire input set until he or she finds
alternate collisions.  Of course, the input set is comprised of limited
range character data.  So, shifting may reduce collisions overall (or may
increase collisions), but it won't change the frequency or probability that
collisions will occur.  I.e., some collisions are still likely to occur.
The attacker just needs to find them.  But, that is no different from the
original set of strings.

Rod Pemberton

Thread

Comparative Productivity of Programming Languages visualforth@rocketmail.com - 2012-08-21 21:43 -0700
  Re: Comparative Productivity of Programming Languages "A. K." <akk@nospam.org> - 2012-08-22 07:07 +0200
  Re: Comparative Productivity of Programming Languages Andrew Haley <andrew29@littlepinkcloud.invalid> - 2012-08-22 03:35 -0500
    Re: Comparative Productivity of Programming Languages John Passaniti <john.passaniti@gmail.com> - 2012-08-22 14:06 -0700
      Function Points (was: Comparative Productivity of Programming Languages) anton@mips.complang.tuwien.ac.at (Anton Ertl) - 2012-08-23 14:50 +0000
        Re: Function Points Paul Rubin <no.email@nospam.invalid> - 2012-08-23 11:43 -0700
          Re: Function Points anton@mips.complang.tuwien.ac.at (Anton Ertl) - 2012-08-25 14:13 +0000
            Re: Function Points Paul Rubin <no.email@nospam.invalid> - 2012-08-25 10:12 -0700
              Re: Function Points Doug Hoffman <glidedog@gmail.com> - 2012-08-25 15:39 -0400
                Re: Function Points Paul Rubin <no.email@nospam.invalid> - 2012-08-25 15:09 -0700
                Re: Function Points "Elizabeth D. Rather" <erather@forth.com> - 2012-08-25 12:34 -1000
                Re: Function Points Paul Rubin <no.email@nospam.invalid> - 2012-08-25 16:43 -0700
                Re: Function Points jacko <jackokring@gmail.com> - 2012-08-25 18:05 -0700
                Re: Function Points jacko <jackokring@gmail.com> - 2012-08-25 20:34 -0700
                Re: Function Points Bernd Paysan <bernd.paysan@gmx.de> - 2012-08-26 03:24 +0200
                Re: Function Points Paul Rubin <no.email@nospam.invalid> - 2012-08-25 22:44 -0700
                Re: Function Points "Elizabeth D. Rather" <erather@forth.com> - 2012-08-25 21:19 -1000
                Re: Function Points Paul Rubin <no.email@nospam.invalid> - 2012-08-26 00:36 -0700
                Re: Function Points "Elizabeth D. Rather" <erather@forth.com> - 2012-08-25 21:50 -1000
                Re: Function Points Paul Rubin <no.email@nospam.invalid> - 2012-08-26 01:08 -0700
                Re: Function Points Bernd Paysan <bernd.paysan@gmx.de> - 2012-08-26 23:20 +0200
                Re: Function Points Paul Rubin <no.email@nospam.invalid> - 2012-08-26 19:33 -0700
                Re: Function Points Andrew Haley <andrew29@littlepinkcloud.invalid> - 2012-08-27 13:34 -0500
                Re: Function Points Bernd Paysan <bernd.paysan@gmx.de> - 2012-08-27 22:38 +0200
                Re: Function Points Andrew Haley <andrew29@littlepinkcloud.invalid> - 2012-08-28 02:45 -0500
                Re: Function Points Paul Rubin <no.email@nospam.invalid> - 2012-08-27 18:14 -0700
                Re: Function Points Paul Rubin <no.email@nospam.invalid> - 2012-08-27 18:24 -0700
                Re: Function Points anton@mips.complang.tuwien.ac.at (Anton Ertl) - 2012-08-30 14:22 +0000
                Re: Function Points Andrew Haley <andrew29@littlepinkcloud.invalid> - 2012-08-28 03:07 -0500
                Re: Function Points Paul Rubin <no.email@nospam.invalid> - 2012-08-28 08:18 -0700
                Re: Function Points Andrew Haley <andrew29@littlepinkcloud.invalid> - 2012-08-28 12:15 -0500
                Re: Function Points Paul Rubin <no.email@nospam.invalid> - 2012-08-28 23:05 -0700
                Re: Function Points Andrew Haley <andrew29@littlepinkcloud.invalid> - 2012-08-29 03:55 -0500
                Re: Function Points Bernd Paysan <bernd.paysan@gmx.de> - 2012-08-27 22:28 +0200
                Re: Function Points Paul Rubin <no.email@nospam.invalid> - 2012-08-27 20:26 -0700
                Re: Function Points Bernd Paysan <bernd.paysan@gmx.de> - 2012-08-28 23:17 +0200
                Re: Function Points Paul Rubin <no.email@nospam.invalid> - 2012-08-29 01:13 -0700
                Re: Function Points Paul Rubin <no.email@nospam.invalid> - 2012-08-29 02:23 -0700
                Re: Function Points Bernd Paysan <bernd.paysan@gmx.de> - 2012-08-30 02:59 +0200
                Re: Function Points Paul Rubin <no.email@nospam.invalid> - 2012-08-29 22:18 -0700
                Re: Function Points Bernd Paysan <bernd.paysan@gmx.de> - 2012-08-30 20:44 +0200
                Re: Function Points Paul Rubin <no.email@nospam.invalid> - 2012-08-31 01:29 -0700
                Re: Function Points anton@mips.complang.tuwien.ac.at (Anton Ertl) - 2012-08-31 09:33 +0000
                Re: Function Points Bernd Paysan <bernd.paysan@gmx.de> - 2012-08-30 02:58 +0200
                Re: Function Points Paul Rubin <no.email@nospam.invalid> - 2012-08-29 19:39 -0700
                Re: Function Points anton@mips.complang.tuwien.ac.at (Anton Ertl) - 2012-08-30 14:10 +0000
                Re: Function Points gavino_himself <visploveslisp@gmail.com> - 2012-08-30 20:08 -0700
                Re: Function Points "Elizabeth D. Rather" <erather@forth.com> - 2012-08-30 17:47 -1000
                Re: Function Points "Elizabeth D. Rather" <erather@forth.com> - 2012-08-27 13:43 -1000
                Re: Function Points "Paul E. Bennett" <Paul_E.Bennett@topmail.co.uk> - 2012-08-27 12:14 +0100
                Re: Function Points Mark Wills <markrobertwills@yahoo.co.uk> - 2012-08-27 05:12 -0700
                Re: Function Points "Paul E. Bennett" <Paul_E.Bennett@topmail.co.uk> - 2012-08-27 15:52 +0100
                Re: Function Points anton@mips.complang.tuwien.ac.at (Anton Ertl) - 2012-08-26 13:09 +0000
                Re: Function Points Paul Rubin <no.email@nospam.invalid> - 2012-08-27 20:52 -0700
                Re: Function Points anton@mips.complang.tuwien.ac.at (Anton Ertl) - 2012-08-30 14:08 +0000
                Re: Function Points Paul Rubin <no.email@nospam.invalid> - 2012-08-30 10:43 -0700
                Re: Function Points "Elizabeth D. Rather" <erather@forth.com> - 2012-08-30 08:25 -1000
                Re: Function Points Bernd Paysan <bernd.paysan@gmx.de> - 2012-08-30 22:42 +0200
                Re: Function Points "Rod Pemberton" <do_not_have@notemailnot.cmm> - 2012-08-31 01:23 -0400
                Re: Function Points Andrew Haley <andrew29@littlepinkcloud.invalid> - 2012-08-31 03:08 -0500
                Re: Function Points "Rod Pemberton" <do_not_have@notemailnot.cmm> - 2012-08-31 18:56 -0400
                Re: Function Points Bernd Paysan <bernd.paysan@gmx.de> - 2012-09-01 02:35 +0200
                Re: Function Points Paul Rubin <no.email@nospam.invalid> - 2012-08-31 23:52 -0700
                Re: Function Points anton@mips.complang.tuwien.ac.at (Anton Ertl) - 2012-09-01 14:27 +0000
                Re: Function Points anton@mips.complang.tuwien.ac.at (Anton Ertl) - 2012-09-01 14:18 +0000
                Re: Function Points Bernd Paysan <bernd.paysan@gmx.de> - 2012-09-01 17:45 +0200
                Re: Function Points anton@mips.complang.tuwien.ac.at (Anton Ertl) - 2012-09-01 16:14 +0000
                Re: Function Points Bernd Paysan <bernd.paysan@gmx.de> - 2012-09-01 19:13 +0200
                Re: Function Points Andrew Haley <andrew29@littlepinkcloud.invalid> - 2012-09-02 03:19 -0500
                Re: Function Points "Rod Pemberton" <do_not_have@notemailnot.cmm> - 2012-09-01 16:18 -0400
                Re: Function Points Bernd Paysan <bernd.paysan@gmx.de> - 2012-09-02 03:04 +0200
                Re: Function Points "Rod Pemberton" <do_not_have@notemailnot.cmm> - 2012-09-02 04:02 -0400
                Re: Function Points Bernd Paysan <bernd.paysan@gmx.de> - 2012-09-02 17:40 +0200
                Re: Function Points jim@rainbarrel.com - 2012-09-02 10:32 -0700
                Re: Function Points Bernd Paysan <bernd.paysan@gmx.de> - 2012-09-02 20:49 +0200
                Re: Function Points "Rod Pemberton" <do_not_have@notemailnot.cmm> - 2012-09-02 16:33 -0400
                Re: Function Points "Rod Pemberton" <do_not_have@notemailnot.cmm> - 2012-09-02 17:03 -0400
                Re: Function Points "Elizabeth D. Rather" <erather@forth.com> - 2012-09-02 09:02 -1000
                Re: Function Points "Rod Pemberton" <do_not_have@notemailnot.cmm> - 2012-09-02 16:35 -0400
                Re: Function Points "Elizabeth D. Rather" <erather@forth.com> - 2012-09-02 13:42 -1000
                Re: Function Points jim@rainbarrel.com - 2012-09-02 16:54 -0700
                Re: Function Points Mark Wills <markrobertwills@yahoo.co.uk> - 2012-09-03 00:29 -0700
                Re: Function Points "Rod Pemberton" <do_not_have@notemailnot.cmm> - 2012-09-03 01:30 -0400
                Re: Function Points "Elizabeth D. Rather" <erather@forth.com> - 2012-09-02 21:21 -1000
                Re: Function Points jim@rainbarrel.com - 2012-09-03 10:37 -0700
                Re: Function Points anton@mips.complang.tuwien.ac.at (Anton Ertl) - 2012-09-04 07:14 +0000
                Re: Function Points Coos Haak <chforth@hccnet.nl> - 2012-09-03 21:12 +0200
                Re: Function Points "Rod Pemberton" <do_not_have@notemailnot.cmm> - 2012-09-03 17:32 -0400
                Re: Function Points "Rod Pemberton" <do_not_have@notemailnot.cmm> - 2012-09-03 17:51 -0400
                Re: Function Points John Passaniti <john.passaniti@gmail.com> - 2012-09-03 22:37 -0700
                Re: Function Points "Rod Pemberton" <do_not_have@notemailnot.cmm> - 2012-09-04 04:25 -0400
                Re: Function Points John Passaniti <john.passaniti@gmail.com> - 2012-09-04 07:35 -0700
                Re: Function Points "Rod Pemberton" <do_not_have@notemailnot.cmm> - 2012-09-05 02:13 -0400
                Re: Function Points "Elizabeth D. Rather" <erather@forth.com> - 2012-09-04 20:18 -1000
                Re: Function Points John Passaniti <john.passaniti@gmail.com> - 2012-09-05 10:56 -0700
                Re: Function Points "Rod Pemberton" <do_not_have@notemailnot.cmm> - 2012-09-05 16:11 -0400
                Re: Function Points John Passaniti <john.passaniti@gmail.com> - 2012-09-05 14:07 -0700
                Re: Function Points "Rod Pemberton" <do_not_have@notemailnot.cmm> - 2012-09-02 16:27 -0400
                Re: Function Points Bernd Paysan <bernd.paysan@gmx.de> - 2012-09-03 00:52 +0200
                Re: Function Points Paul Rubin <no.email@nospam.invalid> - 2012-09-02 16:28 -0700
                Re: Function Points jim@rainbarrel.com - 2012-09-02 16:48 -0700
                Re: Function Points "Rod Pemberton" <do_not_have@notemailnot.cmm> - 2012-09-02 20:21 -0400
                Re: Function Points "Elizabeth D. Rather" <erather@forth.com> - 2012-09-02 14:45 -1000
                Re: Function Points "Rod Pemberton" <do_not_have@notemailnot.cmm> - 2012-09-03 01:12 -0400
                Re: Function Points "Elizabeth D. Rather" <erather@forth.com> - 2012-09-02 21:26 -1000
                Re: Function Points "Rod Pemberton" <do_not_have@notemailnot.cmm> - 2012-09-03 01:06 -0400
                Re: Function Points Mark Wills <markrobertwills@yahoo.co.uk> - 2012-08-31 03:29 -0700
                Re: Function Points anton@mips.complang.tuwien.ac.at (Anton Ertl) - 2012-08-31 10:35 +0000
                Re: Function Points "Rod Pemberton" <do_not_have@notemailnot.cmm> - 2012-08-31 18:49 -0400
                Re: Function Points anton@mips.complang.tuwien.ac.at (Anton Ertl) - 2012-09-01 14:49 +0000
                Re: Function Points "Elizabeth D. Rather" <erather@forth.com> - 2012-09-01 08:36 -1000
                Re: Function Points "Rod Pemberton" <do_not_have@notemailnot.cmm> - 2012-09-01 16:11 -0400
                Re: Function Points Bernd Paysan <bernd.paysan@gmx.de> - 2012-09-03 01:58 +0200
                Re: Function Points Bernd Paysan <bernd.paysan@gmx.de> - 2012-09-01 17:54 +0200
                Re: Function Points "Rod Pemberton" <do_not_have@notemailnot.cmm> - 2012-09-01 16:19 -0400
                Re: Function Points Bernd Paysan <bernd.paysan@gmx.de> - 2012-09-02 03:05 +0200
                Re: Function Points Coos Haak <chforth@hccnet.nl> - 2012-08-31 23:10 +0200
                Re: Function Points "Elizabeth D. Rather" <erather@forth.com> - 2012-08-31 15:50 -1000
                Re: Function Points Paul Rubin <no.email@nospam.invalid> - 2012-09-01 10:31 -0700
                Re: Function Points Bernd Paysan <bernd.paysan@gmx.de> - 2012-09-01 21:52 +0200
                Re: Function Points "Rod Pemberton" <do_not_have@notemailnot.cmm> - 2012-09-01 16:36 -0400
                Re: Function Points Paul Rubin <no.email@nospam.invalid> - 2012-09-01 14:36 -0700
                Re: Function Points Bernd Paysan <bernd.paysan@gmx.de> - 2012-09-02 03:30 +0200
                Re: Function Points Bernd Paysan <bernd.paysan@gmx.de> - 2012-09-02 23:15 +0200
                Re: Function Points Paul Rubin <no.email@nospam.invalid> - 2012-09-02 15:02 -0700
                Re: Function Points Bernd Paysan <bernd.paysan@gmx.de> - 2012-09-03 01:50 +0200
                Re: Function Points jim@rainbarrel.com - 2012-09-02 16:57 -0700
                Re: Function Points Paul Rubin <no.email@nospam.invalid> - 2012-09-03 23:11 -0700
                Re: Function Points Bernd Paysan <bernd.paysan@gmx.de> - 2012-09-04 14:30 +0200
                Re: Function Points Paul Rubin <no.email@nospam.invalid> - 2012-09-04 10:14 -0700
                Re: Function Points Bernd Paysan <bernd.paysan@gmx.de> - 2012-09-04 22:10 +0200
                Re: Function Points Paul Rubin <no.email@nospam.invalid> - 2012-09-06 00:19 -0700
                Re: Function Points Bernd Paysan <bernd.paysan@gmx.de> - 2012-09-06 17:48 +0200
                Re: Function Points Paul Rubin <no.email@nospam.invalid> - 2012-09-06 12:01 -0700
                Re: Function Points Bernd Paysan <bernd.paysan@gmx.de> - 2012-09-06 22:02 +0200
                Re: Function Points Paul Rubin <no.email@nospam.invalid> - 2012-09-06 14:19 -0700
                Heap (was: Function Points) anton@mips.complang.tuwien.ac.at (Anton Ertl) - 2012-09-07 11:30 +0000
                Re: Heap (was: Function Points) Bernd Paysan <bernd.paysan@gmx.de> - 2012-09-07 18:12 +0200
                Re: Heap (was: Function Points) anton@mips.complang.tuwien.ac.at (Anton Ertl) - 2012-09-07 16:48 +0000
                Re: Heap (was: Function Points) Bernd Paysan <bernd.paysan@gmx.de> - 2012-09-07 21:34 +0200
                Re: Heap Gerry Jackson <gerry@jackson9000.fsnet.co.uk> - 2012-09-07 22:04 +0100
                Re: Heap anton@mips.complang.tuwien.ac.at (Anton Ertl) - 2012-09-08 11:52 +0000
                Re: Heap Bernd Paysan <bernd.paysan@gmx.de> - 2012-09-08 22:48 +0200
                Re: Heap (was: Function Points) anton@mips.complang.tuwien.ac.at (Anton Ertl) - 2012-09-08 12:11 +0000
                priority queue (was: Function Points) anton@mips.complang.tuwien.ac.at (Anton Ertl) - 2012-09-03 11:46 +0000
                Re: Function Points Bernd Paysan <bernd.paysan@gmx.de> - 2012-09-03 15:03 +0200
                Re: Function Points mhx@iae.nl (Marcel Hendrix) - 2012-09-03 22:36 +0200
                Re: Function Points mhx@iae.nl (Marcel Hendrix) - 2012-09-06 20:27 +0200
                Re: Function Points Andrew Haley <andrew29@littlepinkcloud.invalid> - 2012-09-02 04:00 -0500
                Re: Function Points visualforth@rocketmail.com - 2012-09-03 10:40 -0700
                Re: Function Points Bernd Paysan <bernd.paysan@gmx.de> - 2012-09-03 20:26 +0200
                Re: Function Points Doug Hoffman <glidedog@gmail.com> - 2012-08-27 11:49 -0400
                Re: Function Points Paul Rubin <no.email@nospam.invalid> - 2012-08-27 09:16 -0700
                Re: Function Points Josh Grams <josh@qualdan.com> - 2012-08-28 22:46 +0000
                Re: Function Points jacko <jackokring@gmail.com> - 2012-08-28 16:06 -0700
                Re: Function Points Doug Hoffman <glidedog@gmail.com> - 2012-08-28 20:50 -0400
              Re: Function Points anton@mips.complang.tuwien.ac.at (Anton Ertl) - 2012-08-26 12:59 +0000
                Re: Function Points Paul Rubin <no.email@nospam.invalid> - 2012-08-26 22:24 -0700
        Re: Function Points (was: Comparative Productivity of Programming Languages) John Passaniti <john.passaniti@gmail.com> - 2012-08-23 15:02 -0700
          Re: Function Points (was: Comparative Productivity of Programming Languages) anton@mips.complang.tuwien.ac.at (Anton Ertl) - 2012-08-25 14:57 +0000
  Re: Comparative Productivity of Programming Languages "Rod Pemberton" <do_not_have@notemailnot.cmm> - 2012-08-22 08:07 -0400
    Re: Comparative Productivity of Programming Languages visualforth@rocketmail.com - 2012-08-22 08:12 -0700
  Re: Comparative Productivity of Programming Languages visualforth@rocketmail.com - 2012-08-22 07:37 -0700

csiph-web