pan3793 commented on PR #8687: URL: https://github.com/apache/hadoop/pull/8687#issuecomment-5323202798
> ... so anyone able to reach the shuffle port gets a timing oracle on a keyed MAC and can recover a valid hash byte by byte to read another job's map outputs. @nishat-06 I understand that from a security perspective, we should use the constant-time method `MessageDigest.isEqual` for key comparison. However, this method only constitutes a very small part of the entire call chain, and the minute difference in its call time will be drowned out by the latency noise of the entire call chain. Therefore, I believe your claimed cracking method is invalid, unless you can prove it in a real setup. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
