Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:72318
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.215.48 as permitted sender)
MIME-Version: 1.0
Sender: yohgaki@gmail.com
In-Reply-To: <CAGa2bXbLsj-YhU1Qze_Kex383H7ZH8=aTRWtEDC=amWbR1AfmA@mail.gmail.com>
References: <9E3AA302-1EC1-4497-996F-716555CAAB64@rouvenwessling.de>
 <CAF+90c-32u=vVy4L4pB_OWGu2VmeUckxq8UW_AVJNC8iDtiWMQ@mail.gmail.com>
 <52F0139C.2060102@sugarcrm.com> <CAGa2bXZhT_8-BEjLuA4EPkZmxtpO1onz7AGTjCE-w85XC5pwdQ@mail.gmail.com>
 <CAGa2bXYab=2DeJu+ESWP_9Vte2FY37L2+kJFnuN4JwUj9Num1w@mail.gmail.com>
 <AC16ADC6-801E-4D0D-9FD4-0BEE2D017E16@rouvenwessling.de> <CAGa2bXa0i6LBykCNChcCXS+zgp+3KfMEi+H=umFAwL1mC0s__Q@mail.gmail.com>
 <CAGa2bXZpcjichYTB1kXDJ5dp4dcB2rdR1jAQo=TKtSK2cNqZFQ@mail.gmail.com>
 <CAGa2bXaJWRMFHgqZSFUyAmhAM5Zf1Cf7F4koPdkdBpwZg3cgsw@mail.gmail.com> <CAGa2bXbLsj-YhU1Qze_Kex383H7ZH8=aTRWtEDC=amWbR1AfmA@mail.gmail.com>
Date: Thu, 6 Feb 2014 14:17:18 +0900
Message-ID: <CAGa2bXbq7PVRGWixCG=SH24dDffATaqaXUaBSjN-Z+TDhp8HuA@mail.gmail.com>
To: =?UTF-8?Q?Rouven_We=C3=9Fling?= <me@rouvenwessling.de>
Cc: Stas Malyshev <smalyshev@sugarcrm.com>, Nikita Popov <nikita.ppv@gmail.com>, 
	PHP internals <internals@lists.php.net>
Content-Type: multipart/alternative; boundary=047d7b8743a41b2dd104f1b5ffce
Subject: Re: [PHP-DEV] [VOTE] Timing attack safe string comparison function
From: yohgaki@ohgaki.net (Yasuo Ohgaki)

--047d7b8743a41b2dd104f1b5ffce
Content-Type: text/plain; charset=UTF-8

It's me again.

On Thu, Feb 6, 2014 at 1:31 PM, Yasuo Ohgaki <yohgaki@ohgaki.net> wrote:

> Sorry for multiple posts.
>
> On Thu, Feb 6, 2014 at 1:20 PM, Yasuo Ohgaki <yohgaki@ohgaki.net> wrote:
>
>> Since comparison of short and/or not hashed data (e.g. user supplied raw
>> password) should
>> not be done as the function name imply, we may better to document so that
>> users always
>> compare hashed values even when they store raw password/etc.
>> So randomized delay may be overkill.
>>
>
> Because user should not pass other than hashed values, we may
> return FALSE simply when length mismatches. Generated hashed
> length should not be a secret. This get rid of length leak issue and
> the function name is good for this purpose and make the operation
> always constant.
>

Since there is internal code that is vulnerable to timing attack,
could you make it PHPAPI?

For example, ext/session/mod_mm.c is comparing session ID using strcmp()

     for (prev = NULL, ret = data->hash[slot]; ret; prev = ret, ret =
ret->next) {
        if (ret->hv == hv && !strcmp(ret->key, key)) {
            break;
        }
    }

Regards,

P.S. Other save handlers are also vulnerable to timing attack.
It could be mitigated the attack by specifying minimum length of session
ID. I'll add this new INI option to session module.

--
Yasuo Ohgaki
yohgaki@ohgaki.net

--047d7b8743a41b2dd104f1b5ffce--