Black-Box HashDoS: Attacking Hash Tables Without Knowing the Hash Function
A new black-box HashDoS technique slows hash-table lookups to linear time without knowing the hash function, including Rust's standard map.
A security write-up describes a black-box HashDoS technique that degrades open-addressing hash-table lookups from expected constant time to linear time without knowing the hash function. The attacker needs interactive lookup, insert, and clear access and uses O(n log n) preparation steps, inferring collisions from timing of long shared key prefixes. The author demonstrates a working attack against Rust's standard-library hash table and notes that the required access is niche and that mitigations exist.
- The attack forces open-addressed hash-table lookups from expected constant time to linear time.
- Preparation takes O(n log n) interactions and does not require the hash function or its seed.
- Timing of long shared string prefixes reveals how many equality comparisons occur.
- A working demonstration targets Rust's standard-library hash table; mitigations are possible.
From the original article
16 min read at orlp.netallows an attacker to pass attacker-chosen string keys to a hash table implementation such that each lookup query takes $O(n)$ instead of the expected $O(1)$ work. The attack takes $O(n \log n)$ interactive steps with the hash
By orlp.net via itamarst · orlp.net
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.