Apparently, Yii web application framework generates some kind of hash value from captcha codes it generates and sends it to the client side so it can be used for client side validation of the captcha codes (without the need to contact the server side for validation every time). client side hash value is indeed generated by a very week homemade hash function (or better to say, some checksum algorithm). It is just the sum of ascii codes of all characters of the captcha code! so several captcha codes may indeed easily create the same checksum. so if an attacker uses it for brute-force attack, it gets an non-deterministic result every time (several character combinations exists that generate the same checksum). Can u please analyze the security of this scheme somewhat more professionally and precisely? Probably some math calculation is needed. can this method be a sane thing? can it be used for severely breaking the security of the captcha system?
yii.validatin.js line 246 (client side javascript captcha validation function):
captcha: function (value, messages, options) {
if (options.skipOnEmpty && pub.isEmpty(value)) {
return;
}
// CAPTCHA may be updated via AJAX and the updated hash is stored in body data
var hash = $('body').data(options.hashKey);
if (hash == null) {
hash = options.hash;
} else {
hash = hash[options.caseSensitive ? 0 : 1];
}
var v = options.caseSensitive ? value : value.toLowerCase();
for (var i = v.length - 1, h = 0; i >= 0; --i) {
h += v.charCodeAt(i);
}
if (h != hash) {
pub.addMessage(messages, options.message, value);
}
},
server side checksum generation function:
/**
* Generates a hash code that can be used for client side validation.
* @param string $code the CAPTCHA code
* @return string a hash code generated from the CAPTCHA code
*/
public function generateValidationHash($code)
{
for ($h = 0, $i = strlen($code) - 1; $i >= 0; --$i) {
$h += ord($code[$i]);
}
return $h;
}
