Re: little request :)

Hi all, On Sat, Feb 8, 2014 at 8:06 AM, Pádraic Brady <padraic.brady@gmail.com>wrote: > Timing attacks are practical. It's been proven. It's accepted as a > security vulnerability (albeit grudgingly I know by those who have to > fix it). It's been fixed in any number of applications already. We > could wait for a hostile attack to actually happen and then actually > be publicised, but why do nothing when the fix is so damn simple? :P > I agree. It's easy to fix by PHP core. There are number of real apps that have deployed mitigation by themselves. There is no reason not to add counter measure for timing attacks. It's mandatory as language. We may make ==/=== timing safe like Python, it may be overkill or may not. Have anyone took benchmark with this? https://github.com/yohgaki/php-src/compare/PHP-5.6-rfc-hash-compare There are number of timing safe comparison functions. BTW, I would like to see comparison between current PHP hash and xxhash/SipHash for PHP array. IIRC, PHP is using BJB's old hash. Other languages adopted SipHash, I think it worth to try or have it already done? Regards, -- Yasuo Ohgaki yohgaki@ohgaki.net