Re: [VOTE] Timing attack safe string comparison function

Hi! > * You are using MAX, i.e. an if-then-else branch. I'm pretty sure that the > if and else branches will have different instruction counts in that case. > Simple alternative would be something fixed like mod_len = known_len+1 or > known_len&1. > * You leak information on mod_len / known_len, because you will have If it's meant to compare hashes and other such things, we can presume the attacker already knows what your code does, and thus knows what the expected hash length is. What he doesn't know is what that hash is. The timing attack is based on the fact that regular comparison drops after first mismatch, so the attacker by trying different first symbols and using time as oracle between match and mismatch, can guess the hash. The length of the hash however is not useful for him - for most standard crypto protocols all lengths are already known and even if you are using some modifications basic crypto principles tell us to assume your algorithm is known to the attacker and thus most probably your known hash length is too. -- Stanislav Malyshev, Software Architect SugarCRM: http://www.sugarcrm.com/ (408)454-6900 ext. 227