Re: Fwd: [php-src] Constant-Time bin2hex() implementation (#909)

That is why I updated the PR and made it add a function (ts_bin2hex()) instead of replacing the existing behavior. I could have sworn I already sent this to the list. On Wed, Nov 26, 2014 at 3:45 PM, Korvin Szanto <korvinszanto@gmail.com> wrote: > I don't like the idea of any mandatory slow down, trivial or not. This > should be opt in. > > On Wed, Nov 26, 2014, 12:28 PM Rasmus Lerdorf <rasmus@lerdorf.com> wrote: > >> -----BEGIN PGP SIGNED MESSAGE----- >> Hash: SHA1 >> >> On 11/26/2014 11:45 AM, Anthony Ferrara wrote: >> >> That seems like a lot of functions to artificially slow down. >> > >> > Well, in most cases it shouldn't slow it down by a non-trivial >> > margin. >> >> If that can be shown definitively, then I would have fewer objections. >> I still worry that it will take some time to get it right and the >> number of security bug reports we would need to deal with against core >> php functions as various security people find info leaks in the >> implementations. That's where having it in a pecl extension initially >> helps because we can react quicker and push out new releases of the >> extension than if we have to release a new version of PHP each time. >> >> - -Rasmus >> -----BEGIN PGP SIGNATURE----- >> Version: GnuPG v1 >> >> iEYEARECAAYFAlR2N6MACgkQlxayKTuqOuBP5QCdHwQMN9BOz6MruWiL3Rt9AGVP >> hU8AnAx4TehiGHbEU+zDdlAg0Y8qnAaw >> =ZbfE >> -----END PGP SIGNATURE----- >> >> -- >> PHP Internals - PHP Runtime Development Mailing List >> To unsubscribe, visit: http://www.php.net/unsub.php >> >>