Re: [VOTE] Timing attack safe string comparison function
| From: | Sara Golemon | Date: | Mon, 03 Feb 2014 16:21:25 +0000 |
| Subject: | Re: [VOTE] Timing attack safe string comparison function | ||
| References: | 1 2 | Groups: | php.internals |
| Request: | Send a blank email to internals+get-72087@lists.php.net to get a copy of this message | ||
On Mon, Feb 3, 2014 at 4:23 AM, Andrea Faulds <ajf@ajf.me> wrote:
> On 02/02/14 22:50, Rouven Weßling wrote:
> I've voted yes. However, at the risk of opening more bikeshedding again, I
> should say that I don't think hash_compare is an appropriate name. It's a
> timing attack-safe string comparison function, so I think something like
> str_equals_time_constant might be better as it is not so much a hash
> comparison function as a string comparison function.
>
I seem to remember that topic coming up (and I agree with you), but I
don't recall anyone coming up with a universally liked name. I
suppose something is better than nothing.
-Sara