Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:70841
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.217.173 as permitted sender)
MIME-Version: 1.0
Sender: yohgaki@gmail.com
In-Reply-To: <3014595E-B155-47F6-AC7B-71083D89525D@rouvenwessling.de>
References: <3014595E-B155-47F6-AC7B-71083D89525D@rouvenwessling.de>
Date: Mon, 23 Dec 2013 08:55:02 +0900
Message-ID: <CAGa2bXbDP8FVmnWxZvJxLdSG_16QcgEjK7qP3N121oEQKxN6Dw@mail.gmail.com>
To: =?UTF-8?Q?Rouven_We=C3=9Fling?= <me@rouvenwessling.de>
Cc: "internals@lists.php.net" <internals@lists.php.net>
Content-Type: multipart/alternative; boundary=001a11c33f5ec78b4f04ee283f62
Subject: Re: [PHP-DEV] [RFC] Timing attack safe string comparison function
From: yohgaki@ohgaki.net (Yasuo Ohgaki)

--001a11c33f5ec78b4f04ee283f62
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

Hi Rouven,

On Mon, Dec 23, 2013 at 2:08 AM, Rouven We=C3=9Fling <me@rouvenwessling.de>=
wrote:

> I'd like to propose this RFC to introduce a time-constant string
> comparison function: https://wiki.php.net/rfc/timing_attack
>
> I will not open the voting before January 7 to account for ho
>

As you mentioned in code, users should not use when known or user supplied
string
is null.

How about add E_NOTICE error for that case?
If user shouldn't then we are better to warn them.

Comparison is good since it always does the same operation based on user
supplied
string. (Unless compiler does optimizations that I don't expect)

Regards,

--
Yasuo Ohgaki
yohgaki@ohgaki.net

--001a11c33f5ec78b4f04ee283f62--