Re: [RFC] Timing attack safe string comparison function

Hi all, On Tue, Dec 24, 2013 at 1:35 PM, Thomas Hruska <thruska@cubiclesoft.com>wrote: > On 12/23/2013 8:59 PM, Jake A. Smith wrote: > >> Hi all, >> >> "strcmp_secure()" or something like this would be good, as it could be >>> >> >> used any security sensitive string comparison. >> >> I like that. It makes sense for the function to be named for what it >> does, not how one hopes or expects it will be used. >> >> JS >> > > Perhaps this could be implemented by adding an optional parameter to the > existing str...cmp() series of functions instead of adding more functions. We may do this. However, strcmp() returns 0 for equal strings while strcmp_secure() will return TRUE for equal strings. We could make strcmp_secure() returns FALSE/0 for equal strings, but it does not make much sense. Perhaps, we need different function name rather than strcmp_secure(). I would like to have dedicated functions for security related features, so that more users aware of issues. Regards, -- Yasuo Ohgaki yohgaki@ohgaki.net