Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Thoughts about disclosure traps for repDS, rbindDS and cDS #254

Open
tombisho opened this issue Dec 2, 2021 · 0 comments
Open

Thoughts about disclosure traps for repDS, rbindDS and cDS #254

tombisho opened this issue Dec 2, 2021 · 0 comments
Labels
Milestone

Comments

@tombisho
Copy link
Contributor

tombisho commented Dec 2, 2021

Attacks that use some kind of index to isolate or duplicate particular rows rely on creating some kind of index vector. Modifications to repDS, rbindDS and cDS might help protect against this style of attack while allowing legitimate use to continue without issue.

The proposals are:

  1. Add concentration traps to rbindDS and cDS to stop vectors like (1,0,0,0,0,0,0,0,0) that can be used to isolate rows
  2. Stop the generation of unique values (ie an index) using repDS. We need to check whether there would be a legitimate reason for doing this. Note that this is not a complete solution, and it is still possible to generate a few different vectors where the rows aren't unique and then combine them with arithmetic operations that result in a vector with unique rows.

The next step might be to stop arithmetic that results in a vector of unique values, but that would stop genuine usage commands

@StuartWheater StuartWheater added this to the v6.4 milestone Sep 30, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Development

No branches or pull requests

2 participants