Re: [RFC] Timing attack safe string comparison function

On 12/23/2013 10:11 AM, Stas Malyshev wrote:

Hi!

I'd like to propose this RFC to introduce a time-constant string comparison function: https://wiki.php.net/rfc/timing_attack

I wonder how practical this would be. There are probably many side channels in PHP related to how PHP manages memory, copies variables, processes opcodes, etc. so I wonder if providing such function for PHP API would practically add anything or if you should be doing crypto that sensitive in PHP anyway?

One of the chaps on SO done a bit of testing, it appears that without usleep in php land you cannot avoid cpu spikes, and so cannot get a reliable vector of attack unless the server side code has been prepared to be attacked. But this is only testing. I see the things you see, however, probably better to do something than nothing I think, this is technically the correct thing to do, and is simple enough, so I say do it ... Cheers Joe