Re: [VOTE] Timing attack safe string comparison function
| From: | Yasuo Ohgaki | Date: | Tue, 18 Mar 2014 01:04:35 +0000 |
| Subject: | Re: [VOTE] Timing attack safe string comparison function | ||
| References: | 1 | Groups: | php.internals |
| Request: | Send a blank email to internals+get-73255@lists.php.net to get a copy of this message | ||
Hi all,
On Mon, Feb 3, 2014 at 7:50 AM, Rouven Weßling <me@rouvenwessling.de> wrote:
> Hi internals,
>
> as I've received no further feedback I've opened the voting on "Timing
> attack safe string comparison function":
>
> - https://wiki.php.net/rfc/timing_attack
>
Is there any progress?
From benchmark result, overhead for timing safe comparison is negligible
with byte by byte comparison.
I would like to see timing safe "===" for 5.6, if it's possible. (== could
be timing safe, too)
Is anyone working on it?
Regards,
--
Yasuo Ohgaki
yohgaki@ohgaki.net