Replace Qt's hashing function with SipHash

This commit replaces MurmurHash with SipHash for all strings longer than
the size of a pointer. The most important difference between those
algorithms is that MurmurHash has this unwelcome property: for two
byte sequences x and y, if you know that x and y have the same hashing
for a given seed, then they have the same hashing for all seeds.

SipHash has no such issue. If the seed changes, the strings that used to
compute to the same hash are no longer likely to do so.

We've chosen to implement a SipHash-1-2 algorithm instead of the regular
2-4 as that has roughly the same performance as the old DJB33XA
algorithm. It's around 50% slower than MurmurHash, which is
acceptable given the added security.

Task-number: QTBUG-47566
Change-Id: I09100678ff4443e6be06fffd14819c8878d223e2
Reviewed-by: Mårten Nordheim <marten.nordheim@qt.io>

1 files changed, 15 insertions, 0 deletions

diff --git a/src/corelib/tools/qt_attribution.json b/src/corelib/tools/qt_attribution.json
new file mode 100644
index 0000000000..928ff537ca
--- /dev/null
+++ b/src/corelib/tools/qt_attribution.json
@@ -0,0 +1,15 @@
+{
+    "Id": "siphash",
+    "Name": "SipHash Algorithm",
+    "QDocModule": "qtcore",
+    "QtUsage": "Used in Qt Core (QHash)",
+
+    "Description": "Implements the SipHash algorithm.",
+    "Homepage": "https://131002.net/siphash/",
+    "DownloadLocation": "https://raw.githubusercontent.com/veorq/SipHash/adcbf09b1684a718f594faa650ffc56bacdb0777/siphash24.c",
+
+    "License": "Creative Commons Zero v1.0 Universal",
+    "LicenseId": "CC0-1.0",
+    "LicenseFile": "LICENSE.siphash",
+    "Copyright": "(C) 2012-2014 Jean-Philippe Aumasson, (C) 2012-2014 Daniel J. Bernstein <djb@cr.yp.to>"
+}