Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:72087
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: softfail (pb1.pair.com: domain golemon.com does not designate 209.85.160.50 as permitted sender)
MIME-Version: 1.0
Sender: php@golemon.com
In-Reply-To: <52EF8A59.1050709@ajf.me>
References: <9E3AA302-1EC1-4497-996F-716555CAAB64@rouvenwessling.de>
	<52EF8A59.1050709@ajf.me>
Date: Mon, 3 Feb 2014 08:21:25 -0800
Message-ID: <CAESVnVq4VyXxgE9EYVjE_rv6QUZq8cHJqi7suFRjrP4wxAd+bA@mail.gmail.com>
To: Andrea Faulds <ajf@ajf.me>
Cc: =?ISO-8859-1?Q?Rouven_We=DFling?= <me@rouvenwessling.de>, 
	PHP internals <internals@lists.php.net>
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable
Subject: Re: [PHP-DEV] [VOTE] Timing attack safe string comparison function
From: pollita@php.net (Sara Golemon)

On Mon, Feb 3, 2014 at 4:23 AM, Andrea Faulds <ajf@ajf.me> wrote:
> On 02/02/14 22:50, Rouven We=DFling wrote:
> I've voted yes. However, at the risk of opening more bikeshedding again, =
I
> should say that I don't think hash_compare is an appropriate name. It's a
> timing attack-safe string comparison function, so I think something like
> str_equals_time_constant might be better as it is not so much a hash
> comparison function as a string comparison function.
>
I seem to remember that topic coming up (and I agree with you), but I
don't recall anyone coming up with a universally liked name.  I
suppose something is better than nothing.

-Sara