Doc #68328 [Asn]: hash_equals does not mention that a difference in str length will leak

Edit report at https://bugs.php.net/bug.php?id=68328&edit=1 ID: 68328 Updated by: mikemike@php.net Reported by: asphp at dsgml dot com Summary: hash_equals does not mention that a difference in str length will leak Status: Assigned Type: Documentation Problem Package: Documentation problem PHP Version: Irrelevant Assigned To: mikemike Block user comment: N Private report: N New Comment: A patch has been added reflecting this change. It may take a few hours to make its way across all mirrors. Thank you Previous Comments: ------------------------------------------------------------------------ [2014-10-30 10:04:52] mikemike@php.net Automatic comment from SVN on behalf of mikemike Revision: http://svn.php.net/viewvc/?view=revision&revision=335150 Log: Added word 'immediately' to add clarity, address bug #68328 ------------------------------------------------------------------------ [2014-10-30 09:40:09] asphp at dsgml dot com Also on the note change it to say "FALSE is returned immediately and the". (i.e. add the word immediately.) ------------------------------------------------------------------------ [2014-10-30 09:38:45] asphp at dsgml dot com I did not see the note. The information in it should be added to the Description near "This function should be used to mitigate timing attacks". ------------------------------------------------------------------------ [2014-10-30 09:26:34] mikemike@php.net There is already a note present, which reads: -- Note: Both arguments must be of the same length to be compared successfully. When arguments of differing length are supplied, FALSE is returned and the length of the known string may be leaked in case of a timing attack. -- Can you supply an instance where returning false is an issue? ------------------------------------------------------------------------ [2014-10-30 07:27:50] asphp at dsgml dot com Description: ------------ --- From manual page: http://www.php.net/function.hash-equals --- You should document that hash_equals will immediately return false if the strings differ in length. It doesn't even try to compare the strings up to whichever is shorter. It just returns false right away. In some applications this is a problem, so it should be documented. Note: See also Bug #67939 ------------------------------------------------------------------------ -- Edit this bug report at https://bugs.php.net/bug.php?id=68328&edit=1