Re: [VOTE] Timing attack safe string comparison function
| From: | Sara Golemon | Date: | Mon, 03 Feb 2014 16:18:49 +0000 |
| Subject: | Re: [VOTE] Timing attack safe string comparison function | ||
| References: | 1 | Groups: | php.internals |
| Request: | Send a blank email to internals+get-72086@lists.php.net to get a copy of this message | ||
On Sun, Feb 2, 2014 at 2:50 PM, Rouven Weßling <me@rouvenwessling.de> wrote:
> as I've received no further feedback I've opened the voting on "Timing attack
> safe string comparison function":
>
> - https://wiki.php.net/rfc/timing_attack
>
> Voting ends on 2014/02/09 11:00PM UTC
>
Voted yes, but IMO the comparison function should behave a little more
like ===. That is: something like hash_compare(null,"") should return
false. Possibly be even more strict and require both input parameters
to be string (e.g. hash_compare(123,123) would return false as well).
But there's some "non-PHP"ish about that idea so I'm not horribly fussed by it.
-Sara