Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:70850
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.215.51 as permitted sender)
MIME-Version: 1.0
Sender: yohgaki@gmail.com
In-Reply-To: <52B7FDB2.9080702@php.net>
References: <3014595E-B155-47F6-AC7B-71083D89525D@rouvenwessling.de> <52B7FDB2.9080702@php.net>
Date: Mon, 23 Dec 2013 18:45:50 +0900
Message-ID: <CAGa2bXZkhPDNcOR9z1_3_J7nyV=dwtZNktvsFCcxiXAqCOo9Pg@mail.gmail.com>
To: Joe Watkins <krakjoe@php.net>
Cc: "internals@lists.php.net" <internals@lists.php.net>, =?UTF-8?Q?Rouven_We=C3=9Fling?= <me@rouvenwessling.de>
Content-Type: multipart/alternative; boundary=001a11c25e509ac33d04ee3080d1
Subject: Re: [PHP-DEV] Re: [RFC] Timing attack safe string comparison function
From: yohgaki@ohgaki.net (Yasuo Ohgaki)

--001a11c25e509ac33d04ee3080d1
Content-Type: text/plain; charset=UTF-8

Hi Joe,

On Mon, Dec 23, 2013 at 6:09 PM, Joe Watkins <krakjoe@php.net> wrote:

>         It might have more traction if the function were named
> password_compare or hash_compare or something similar that gives everyone
> the idea that it is not simply a string comparison function but the correct
> way to verify in particular passwords/hashes or whatever. I'd be much more
> inclined to say that's a good idea, providing a full set of tools for
> password related foo.


Good name would help for sure.
+1

Since this is new function independent from any other feature and could use
fix
vulnerability in user code, it would be better if we add this to 5.5.

Regards,

--
Yasuo Ohgaki
yohgaki@ohgaki.net

--001a11c25e509ac33d04ee3080d1--