Re: [RFC] Timing attack safe string comparison function
| From: | Yasuo Ohgaki | Date: | Fri, 27 Dec 2013 21:57:00 +0000 |
| Subject: | Re: [RFC] Timing attack safe string comparison function | ||
| References: | 1 2 3 4 5 6 | Groups: | php.internals |
| Request: | Send a blank email to internals+get-70885@lists.php.net to get a copy of this message | ||
Hi all,
On Sat, Dec 28, 2013 at 3:12 AM, Adam Harvey <aharvey@php.net> wrote:
> > Lastly, please stay away from names like "strcmp_secure()". 5-10
> > years from now such a function will inevitably turn out to be insecure
> > in some way and we'll need to add
> > strcmp_really_secure_I_mean_it_this_time(). That way lies madness.
>
> +1. I don't know what a good name is, but anything with the word
> "secure" isn't it. str_compare_constant_time()?
str_compare_constatnt_time() sounds good name to me.
Regards,
--
Yasuo Ohgaki
yohgaki@ohgaki.net