Re: [RFC] Timing attack safe string comparison function

Hi! > I'd like to propose this RFC to introduce a time-constant string > comparison function: https://wiki.php.net/rfc/timing_attack I wonder how practical this would be. There are probably many side channels in PHP related to how PHP manages memory, copies variables, processes opcodes, etc. so I wonder if providing such function for PHP API would practically add anything or if you should be doing crypto that sensitive in PHP anyway? -- Stanislav Malyshev, Software Architect SugarCRM: http://www.sugarcrm.com/ (408)454-6900 ext. 227