note 121757 deleted from function.hash-equals by cmb

Note Submitter: jcastromail at yahoo dot es ---- What is a timing attack? In short, a timing attack is a way to predict a encryption by using the time to takes to compare two encrypted values. Depending the encryption, if you want to compare two encrypted values, if one of them is completely different then the system takes less time than if it has something similarities The difference of time is usually in microseconds. So, giving several attempts, in theory its possible to crack a system. However, usually a system is composed by several services and serving more than a customer at the same time. So, even the interval of time of execute an operation PHP is always variable, its not exact at all. For example, if you run a benchmark in php <?php $time_start = microtime(true); $expected = crypt('12345', '$2a$07$usesomesillystringforsalt$'); $correct = crypt('12345', '$2a$07$usesomesillystringforsalt$'); $result=hash_equals($expected, $correct); $time_end = microtime(true); echo $time_end - $time_start; ?> or <?php $time_start = microtime(true); $expected = crypt('12345', '$2a$07$usesomesillystringforsalt$'); $correct = crypt('12345', '$2a$07$usesomesillystringforsalt$'); $result=$expected==$correct; $time_end = microtime(true); echo $time_end - $time_start; ?> you will get different values each time you run it. So, we are free of timing attack without even using this function, and we aren't even considering the delay of the network, delay of the browser and so on. Even in the same machine and running So, in theory a timing attack is possible, however empirically its not.