Re: [RFC] Timing attack safe string comparison function
| From: | Yasuo Ohgaki | Date: | Sat, 28 Dec 2013 00:39:06 +0000 |
| Subject: | Re: [RFC] Timing attack safe string comparison function | ||
| References: | 1 2 3 4 5 6 7 8 | Groups: | php.internals |
| Request: | Send a blank email to internals+get-70890@lists.php.net to get a copy of this message | ||
Hi Jake,
On Sat, Dec 28, 2013 at 9:02 AM, Jake A. Smith <theman@jakeasmith.com>wrote:
> Rather than str_compare_constant_time() would it be better to call it
> strcmp_constant_time() to keep things consistent?
Since strcmp() returns 0 for equal, it might be better not to name
strcmp_something() even though I proposed strcmp_secure() at first.
Regards,
--
Yasuo Ohgaki
yohgaki@ohgaki.net