Re: [VOTE] Timing attack safe string comparison function
| From: | Yasuo Ohgaki | Date: | Thu, 06 Feb 2014 23:05:05 +0000 |
| Subject: | Re: [VOTE] Timing attack safe string comparison function | ||
| References: | 1 | Groups: | php.internals |
| Request: | Send a blank email to internals+get-72351@lists.php.net to get a copy of this message | ||
Hi Rouven,
I made SipHash version of str_compare() as a sample.
There is timing safe php_compare(), which is stolen from BSD.
https://github.com/yohgaki/php-src/compare/PHP-5.6-rfc-hash-compare
[yohgaki@dev github-php-src]$ ./php-bin -r 'var_dump(str_compare("abc",
"abc"));'
bool(true)
[yohgaki@dev github-php-src]$ ./php-bin -r 'var_dump(str_compare("asfasdf",
"slkjojoeiwrj"));'
bool(false)
It's quick patch made less than 30 min.
So it can be improved, I suppose.
Regards,
--
Yasuo Ohgaki
yohgaki@ohgaki.net