Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:72320
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.216.177 as permitted sender)
MIME-Version: 1.0
In-Reply-To: <52F30E3B.1090302@oracle.com>
References: <9E3AA302-1EC1-4497-996F-716555CAAB64@rouvenwessling.de>
	<CAF+90c-32u=vVy4L4pB_OWGu2VmeUckxq8UW_AVJNC8iDtiWMQ@mail.gmail.com>
	<52F0139C.2060102@sugarcrm.com>
	<CAGa2bXZhT_8-BEjLuA4EPkZmxtpO1onz7AGTjCE-w85XC5pwdQ@mail.gmail.com>
	<CAGa2bXYab=2DeJu+ESWP_9Vte2FY37L2+kJFnuN4JwUj9Num1w@mail.gmail.com>
	<AC16ADC6-801E-4D0D-9FD4-0BEE2D017E16@rouvenwessling.de>
	<CAGa2bXa0i6LBykCNChcCXS+zgp+3KfMEi+H=umFAwL1mC0s__Q@mail.gmail.com>
	<CAGa2bXZpcjichYTB1kXDJ5dp4dcB2rdR1jAQo=TKtSK2cNqZFQ@mail.gmail.com>
	<52F30E3B.1090302@oracle.com>
Date: Thu, 6 Feb 2014 06:24:53 +0100
Message-ID: <CAEZPtU7q=JGj+HzCPterVWFEL4YykrfAkPwhbFwt1WnHBMHadQ@mail.gmail.com>
To: Christopher Jones <christopher.jones@oracle.com>
Cc: Yasuo Ohgaki <yohgaki@ohgaki.net>, "internals@lists.php.net" <internals@lists.php.net>, 
	=?UTF-8?Q?Rouven_We=C3=9Fling?= <me@rouvenwessling.de>
Content-Type: text/plain; charset=UTF-8
Subject: Re: [PHP-DEV] [VOTE] Timing attack safe string comparison function
From: pierre.php@gmail.com (Pierre Joye)

On Thu, Feb 6, 2014 at 5:23 AM, Christopher Jones
<christopher.jones@oracle.com> wrote:
>
> On 2/5/14 7:56 PM, Yasuo Ohgaki wrote:
>>
>> Hi all,
>>
>> Padraic gave me an another idea of additional mitigation for this.
>
>
> What's the status of the RFC?


Voting phase

> It's listed as under voting but there
> is deep discussion still ongoing.

Yes, a request for peer review has been asked, that's why I asked a
couple of security related contacts to take a look at the code. It
cannot hurt.

> The RFC is very short on technical
> detail.  It is also lacking an end-of-vote date.

It is one week, so let add it :)

> It's not clear what
> the RFCs path forward is.  (If this info is in a mail thread, but not
> in the RFC then remember readers/voters should not have to trawl
> internals mail to understand the proposal and its direction).
>
> Personally, I suggest the vote be closed/withdrawn with the assumption
> the concept was accepted 15 to 1.  Then work on the code until a
> mutually acceptable and useful implementation is found.  After that, a
> quick vote can be made on the implementation.

We do not have to over react here, it is, for a change, that there is
clear concensus about the need or wish for this feature. It is not a
trivial thing to implement but we have time to make it rock solid
until final 5.6.0.

Cheers,
-- 
Pierre

@pierrejoye | http://www.libgd.org