Re: [VOTE] Timing attack safe string comparison function
| From: | Yasuo Ohgaki | Date: | Mon, 10 Feb 2014 01:37:58 +0000 |
| Subject: | Re: [VOTE] Timing attack safe string comparison function | ||
| References: | 1 2 3 4 5 | Groups: | php.internals |
| Request: | Send a blank email to internals+get-72424@lists.php.net to get a copy of this message | ||
Hi Dmitry,
On Mon, Feb 10, 2014 at 10:15 AM, Yasuo Ohgaki <yohgaki@ohgaki.net> wrote:
> str_word_compare Elapsed: 1.337508 Iterations: 1000000 DataSize: 128
> str_compare Elapsed: 1.194582 Iterations: 1000000 DataSize: 128
>
> str_word_compare() is the winner for relatively large data.
>
It seems the difference is marginal. It may be better to make ==/=== string
comparison timing safe by default if php_word_compare() implementation
does not have timing issue.
Patch for php_word_compare() is
https://github.com/yohgaki/php-src/commit/302a53db87c93b469fb85041e8c505207e3a6d9c
What do you think?
Regards,
P.S.
xxhash32 is surprisingly fast, but it has limited hash space. Therefore,
it's not a good idea to use it for string comparison. IIRC or if it did not
changed, Zend uses old DJB hash. It may be good idea to use xxhash
for PHP array.
--
Yasuo Ohgaki
yohgaki@ohgaki.net