Re: [RFC] Timing attack safe string comparison function
| From: | Jake A. Smith | Date: | Sat, 28 Dec 2013 00:02:53 +0000 |
| Subject: | Re: [RFC] Timing attack safe string comparison function | ||
| References: | 1 2 3 4 5 6 7 | Groups: | php.internals |
| Request: | Send a blank email to internals+get-70889@lists.php.net to get a copy of this message | ||
On Fri, Dec 27, 2013 at 3:57 PM, Yasuo Ohgaki <yohgaki@ohgaki.net> wrote:
> Hi all,
>
> On Sat, Dec 28, 2013 at 3:12 AM, Adam Harvey <aharvey@php.net> wrote:
>
> > > Lastly, please stay away from names like "strcmp_secure()". 5-10
> > > years from now such a function will inevitably turn out to be insecure
> > > in some way and we'll need to add
> > > strcmp_really_secure_I_mean_it_this_time(). That way lies madness.
> >
> > +1. I don't know what a good name is, but anything with the word
> > "secure" isn't it. str_compare_constant_time()?
>
>
> str_compare_constatnt_time() sounds good name to me.
>
> Regards,
>
> --
> Yasuo Ohgaki
> yohgaki@ohgaki.net
>
I had to chuckle at strcmp_really_secure_I_mean_it_this_time(). I agree
though, calling it secure is a bad idea.
Rather than str_compare_constant_time() would it be better to call it
strcmp_constant_time() to keep things consistent?
JS
--
Jake A. Smith | @jakeasmith