Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:72120
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.215.48 as permitted sender)
MIME-Version: 1.0
Sender: yohgaki@gmail.com
In-Reply-To: <CAGa2bXYc2iRsW6fmSpyqr-N-g-Mrj9PEyVoc0ckBwRoLdtepXQ@mail.gmail.com>
References: <9E3AA302-1EC1-4497-996F-716555CAAB64@rouvenwessling.de>
 <CAF+90c-32u=vVy4L4pB_OWGu2VmeUckxq8UW_AVJNC8iDtiWMQ@mail.gmail.com> <CAGa2bXYc2iRsW6fmSpyqr-N-g-Mrj9PEyVoc0ckBwRoLdtepXQ@mail.gmail.com>
Date: Tue, 4 Feb 2014 06:04:35 +0900
Message-ID: <CAGa2bXZJ3Uo5XRmMxxwyR0apDcp61fY0NokajfX2eFtNgtHytg@mail.gmail.com>
To: Nikita Popov <nikita.ppv@gmail.com>
Cc: =?UTF-8?Q?Rouven_We=C3=9Fling?= <me@rouvenwessling.de>, 
	PHP internals <internals@lists.php.net>
Content-Type: multipart/alternative; boundary=047d7b3a83005403bd04f186e197
Subject: Re: [PHP-DEV] [VOTE] Timing attack safe string comparison function
From: yohgaki@ohgaki.net (Yasuo Ohgaki)

--047d7b3a83005403bd04f186e197
Content-Type: text/plain; charset=UTF-8

Hi all,

We can be more conservative.
So 127 is not long enough for SHA-512, make it 256 for larger hashes?

On Tue, Feb 4, 2014 at 5:57 AM, Yasuo Ohgaki <yohgaki@ohgaki.net> wrote:

> Length leak is known issue and we may improve these. There was discussion
> for this.
> For the sake of completeness, we may address issues now or later.
>
> To be honest, I think length leak must be avoided especially for shorter
> strings.
> It would be better to iterate at least 100 times regardless of input.
>
> Perhaps, something like
>
> + /**
>  + * If known_string has a length of 0 we set the length to 1,
>  + * this will cause us to compare all bytes of userString with the null
> byte which fails
>  + */
>  + mod_len = MAX(known_len, 1);
> len = MAX(known_len, 127);
>
len = MAX(known_len, 256);

>  +
>  + /* This is security sensitive code. Do not optimize this for speed. */
>  + result = known_len - user_len;
>
> +	for (j = 0; j < user_len; j++) {
>
> for (j = 0; j < len; j++) {
>
>
> +		result |= known_str[j % mod_len] ^ user_str[j];
>
> result |= known_str[j % known_len] ^ user_str[j % user_len];
>  + }
>

Regards,

--
Yasuo Ohgaki
yohgaki@ohgaki.net

--047d7b3a83005403bd04f186e197--