Implement xxHash for non-cryptographic use-cases

Created on 3 September 2022, almost 3 years ago
Updated 10 July 2023, about 2 years ago

Problem/Motivation

PHP 8.1 adds support for xxHash - a very fast, collision-resistant, non-crytographic hash.

We use a lot of hashes for non-crypto purposes, and our approach flip-flops between using weak non-crypto hashes like crc32, or mis-using cryptographic hashes to be 'correct'. xxHash means we don't need to flip-flop any more.

Steps to reproduce

Proposed resolution

Remaining tasks

Open sub-issues for each hash usage we want to change, including the recently added one in #2531564: Fix leaky and brittle container serialization solution β†’ .

User interface changes

API changes

Data model changes

Release notes snippet

πŸ“Œ Task
Status

Needs work

Version

10.0 ✨

Component
BaseΒ  β†’

Last updated about 2 hours ago

Created by

πŸ‡¬πŸ‡§United Kingdom catch

Live updates comments and jobs are added and updated live.
Sign in to follow issues

Comments & Activities

Not all content is available!

It's likely this issue predates Contrib.social: some issue and comment data are missing.

  • Open on Drupal.org β†’
    Environment: PHP 8.1 & MySQL 5.7
    last update about 2 years ago
    Not currently mergeable.
  • @catch opened merge request.
  • First commit to issue fork.
  • @catch opened merge request.
  • πŸ‡¬πŸ‡§United Kingdom catch

    The fork was too far behind (early 10.x branch) to be able to rebase on, so cherry-picked the one commit that still applied to 11.x, recreated one more of @neclimdul's and pushed a new branch.

    Also adding PermissionsHashGenerator here after discovering it makes debugging test cache changes unhelpfully difficult. We probably need to split that to its own issue though because it'll likely need constructor deprecations and a double check that it's definitely not security sensitive (I don't think it is though, it's a hash of permissions, not account information otherwise).

  • First commit to issue fork.
  • πŸ‡ΊπŸ‡ΈUnited States nicxvan

    Applied some suggestions for cs and stan.

  • πŸ‡ΊπŸ‡ΈUnited States nicxvan

    Ah core services needs to be updated too.

  • πŸ‡ΊπŸ‡ΈUnited States nicxvan

    Is there a reason not to use xxh3?

    https://xxhash.com/

    It seems to be supported and faster, but I'll admit I'm not super familiar with this so I may be missing something.

  • πŸ‡¬πŸ‡§United Kingdom catch

    Can't see any reason not to use xxh3, probably got thrown off by it being 'new' but it was included in PHP 8.1

  • πŸ‡¬πŸ‡§United Kingdom catch

    The MR is back to green, but we need to figure out scope here. There are other sha256 and other hash usages in core we can probably convert.

    Also not sure whether we want to spin-off PermissionsHashGenerator and any other logic changes to their own issues. Also noticed in the twig change that we're using Crypt::base64Encode() purely to base64 encode a hash but I think that's already the case with xxh3 so we could probably use xxh3 for that case too.

Production build 0.71.5 2024