Mailing-List: contact embperl-help@perl.apache.org; run by ezmlm
Precedence: bulk
Received-SPF: pass (hermes.apache.org: local policy)
Date: Mon, 15 Nov 2004 18:24:06 +0000 (GMT)
From: Ed Grimm <edgrimm@dsblade00.wat.us.ray.com>
Sender: edgrimm@dsblade00.wat.us.ray.com
Reply-To: Ed Grimm <eg@raytheon.com>
To: "'Embperl List'" <embperl@perl.apache.org>
cc: "'Stefan Cars'" <stefan@snowfall.se>
Subject: RE: Sessions get mixed up ?
In-Reply-To: <20041115132300.5B4D3DCA9F@lnx1.i.ecos.de>
Message-ID: <Pine.GSO.4.58.0411151716460.5760@dsblade00>
References: <20041115132300.5B4D3DCA9F@lnx1.i.ecos.de>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII

On Mon, 15 Nov 2004, Gerald Richter wrote:

> Hi,
>
>> The problem is that this happens maybe once or twice a month (we have
>> about 10-15 thousands login per day). So it's really hard to
>> reproduce, and as far as I understand wouldn't the closure problem
>> create this problem more often ?)
>
> Yes, the closure problem should create the problem more often.
>
> If it happens so seldom, it really might be a problem of generating
> session ids.
>
> Apache::Session generates the id by doing a md5 hash on a random
> number (time () . {} . Rand() . $$) , maybe there are situation where
> it generates the same id (also this should normaly not happen).

MD5 hash collisions very well could have that frequency, at that volume.

How hard would it be to change the code to use a SHA or SSHA hash
instead?  (Admittedly, I'm picking a more cryptographically secure hash
at psuedo-random; there may be one that's more appropriate.)  Note that
I realize they take longer to generate, but that time only happens at
login, not per page view, and it should reduce the hash collision rate
dramatically.

Ed

---------------------------------------------------------------------
To unsubscribe, e-mail: embperl-unsubscribe@perl.apache.org
For additional commands, e-mail: embperl-help@perl.apache.org