note 111435 added to function.hash-hmac

Please be careful when comparing hashes. In certain cases, information can be leaked by using a timing attack. It takes advantage of the == operator only comparing until it finds a difference in the two strings. To prevent it, you have two options. Option 1: hash both hashed strings first - this doesn't stop the timing difference, but it makes the information useless. <?php if (md5($hashed_value) === md5($hashed_expected)) { echo "hashes match!"; } ?> Option 2: always compare the whole string. <?php if (hash_compare($hashed_value, $hashed_expected)) { echo "hashes match!"; } function hash_compare($a, $b) { if (!is_string($a) || !is_string($b)) { return false; } $lena = strlen($a); $lenb = strlen($b); if ($lena !== $lenb) { return false; } $match = true; for ($i = 0; $i < $lena; $i++) { $match = $match && ((ord($a[$i]) ^ ord($b[$i])) === 0); } return $match; } ---- Server IP: 69.147.83.199 Probable Submitter: 66.194.104.5 ---- Manual Page -- http://php.net/manual/en/function.hash-hmac.php Edit -- https://master.php.net/note/edit/111435 Del: integrated -- https://master.php.net/note/delete/111435/integrated Del: useless -- https://master.php.net/note/delete/111435/useless Del: bad code -- https://master.php.net/note/delete/111435/bad+code Del: spam -- https://master.php.net/note/delete/111435/spam Del: non-english -- https://master.php.net/note/delete/111435/non-english Del: in docs -- https://master.php.net/note/delete/111435/in+docs Del: other reasons-- https://master.php.net/note/delete/111435 Reject -- https://master.php.net/note/reject/111435 Search -- https://master.php.net/manage/user-notes.php