title: Application vulnerability due to Non Random Hash Functions
body: <p>Below excerpt is from an <a href="http://www.ocert.org/advisories/ocert-2011-003.html">article</a> that explains possibility of Denial Of Service(DoS) attack because of non random hash functions used in Hash Data Structures. </p>
  
  <blockquote>
    <p>[…] the condition can be leveraged by exploiting predictable collisions in the underlying hashing algorithms.</p>
  </blockquote>
  
  <p>In order to verify it I went through reference implementation of Java HashMap from Oracle and indeed found a static hash functions used: </p>
  
  <pre><code>    static int hash(int h) {
         h ^= (h &gt;&gt;&gt; 20) ^ (h &gt;&gt;&gt; 12);
         return h ^ (h &gt;&gt;&gt; 7) ^ (h &gt;&gt;&gt; 4);
      }
  </code></pre>
  
  <p>Another <a href="http://www.nruns.com/_downloads/advisory28122011.pdf">paper</a> on the topic tells:</p>
  
  <blockquote>
    <p>A Tomcat 6.0.32 server parses a 2 MB string of colliding keys in about
    44 minutes of i7 CPU time, so an attacker with about 6 kbit/s can keep one i7 core constantly 
    busy. If the attacker has a Gigabit connection, he can keep about 100.000 i7 cores busy</p>
  </blockquote>
  
  <p>How can we safeguard against this vulnerability. Moreover so with so many of softwares we use being open source (Tomcat etc.) which rely on this implementation.</p>