Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:72776
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain rouvenwessling.de designates 5.35.242.46 as permitted sender)
Content-Type: text/plain; charset=us-ascii
Mime-Version: 1.0 (Mac OS X Mail 7.0 \(1822\))
In-Reply-To: <CAGa2bXYz0o=swhqt=OrwdxFScA=LuxZQ=8vpvMxEJj7_FTZUeQ@mail.gmail.com>
Date: Sun, 23 Feb 2014 22:05:43 +0100
Cc: PHP internals <internals@lists.php.net>,
 Solar Designer <solar@openwall.com>
Content-Transfer-Encoding: quoted-printable
Message-ID: <8092191F-9B60-43C3-91A8-095FB74C02A5@rouvenwessling.de>
References: <9E3AA302-1EC1-4497-996F-716555CAAB64@rouvenwessling.de> <3EAEC401-F0FF-42E6-8B93-41D2E8658A80@rouvenwessling.de> <47C11B57-84E9-4805-9952-1E78A9F112C5@rouvenwessling.de> <CAGa2bXYz0o=swhqt=OrwdxFScA=LuxZQ=8vpvMxEJj7_FTZUeQ@mail.gmail.com>
To: Yasuo Ohgaki <yohgaki@ohgaki.net>
Subject: Re: [PHP-DEV] [VOTE] Timing attack safe string comparison function
From: me@rouvenwessling.de (=?iso-8859-1?Q?Rouven_We=DFling?=)

Hi Yasuo,

On 23.02.2014, at 21:59, Yasuo Ohgaki <yohgaki@ohgaki.net> wrote:

> I did some experiments. It seems it's good to implement timing safe =
comparison in engine. i.e. We can make =3D=3D/=3D=3D=3D secure by =
default like Python. It would be much safer get rid of all timing from =
PHP.
>=20
> We need new RFC to include the change in engine.


That's not how I read that discussion (though I might have missed a =
mail). Also personally I don't like it. I don't see that the supposed =
gain in security is worth the performance implication. Also if it turns =
out there's a bug, and we'd have to make it 100 times slower for some =
reason, than that's not a big deal for a function like hash_equals. It =
is however if it affects all comparisons.

Since I don't believe in that change, I'm not interested in proposing =
that RFC.

Best regards
Rouve=