Two Hours Of Perl

Crosby and Wallach precomputed about 100k colliding 24-character strings against Perl 5.6.1's hash function, then loaded them into an associative array. Their measurements:

input	Perl 5.6.1	Perl 5.8.0
90k strings tuned to 5.6.1	6506 s	under 2 s
90k strings tuned to 5.8.0	under 2 s	6838 s

You maintain a Perl service that stores user-submitted form field names in a hash. Assume the attacker has your source code. Which change removes the vulnerability without changing which entries the hash ends up storing?

Lower the load factor threshold so the table grows earlier and keeps chains short

Draw the hash function at process start from a universal family keyed by a random seed, so the attacker cannot compute inputs that collide in this particular process

Replace the hash function with MD5 truncated to the bucket count, since MD5 is collision resistant

Stop following a chain after 100 entries and treat the lookup as a miss