Newsgroups: php.internals Path: news.php.net Xref: news.php.net php.internals:73255 Return-Path: Mailing-List: contact internals-help@lists.php.net; run by ezmlm Delivered-To: mailing list internals@lists.php.net Received: (qmail 95484 invoked from network); 18 Mar 2014 01:05:19 -0000 Received: from unknown (HELO lists.php.net) (127.0.0.1) by localhost with SMTP; 18 Mar 2014 01:05:19 -0000 Authentication-Results: pb1.pair.com smtp.mail=yohgaki@gmail.com; spf=pass; sender-id=pass Authentication-Results: pb1.pair.com header.from=yohgaki@gmail.com; sender-id=pass Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.217.181 as permitted sender) X-PHP-List-Original-Sender: yohgaki@gmail.com X-Host-Fingerprint: 209.85.217.181 mail-lb0-f181.google.com Received: from [209.85.217.181] ([209.85.217.181:50177] helo=mail-lb0-f181.google.com) by pb1.pair.com (ecelerity 2.1.1.9-wez r(12769M)) with ESMTP id 41/C6-17561-ECB97235 for ; Mon, 17 Mar 2014 20:05:18 -0500 Received: by mail-lb0-f181.google.com with SMTP id c11so4288682lbj.12 for ; Mon, 17 Mar 2014 18:05:15 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:sender:in-reply-to:references:from:date:message-id :subject:to:cc:content-type; bh=OSYQM9Y2pS1VddVF6gW1RZ5feWnPpigtSFNMNALlOFk=; b=TMjBqltlOVFXBaPD5025UIbRwwDmtZJftdv2Y3Ni1tHCcH6tLtb/CMhtIbYgifStxp sMf48HQQQtUDb0vOwOScz8TB+Nz1e1SG17N77RUuNsP+maxH99JzlmX+3MVtvEY/u+h1 6ny/lFQybXfx0TAJcx7xckpRcz1MO5dB7ivsFQ8SfVGZ/sb5sa+w7JMBRa+DrwlgGdAi 4K8fxnq3V6XAPcC+tko/C3wR9GodblbFbjjuPPY+9atfxC+n2urFSsY4siHaVL+2d8lU pKmVO4Ni5MLYrXDKxacQtooEyAyKcFkv+zFbC8UfsH3FBj/F4fMSlSgjwf5oN3O3qfaH 968g== X-Received: by 10.112.50.194 with SMTP id e2mr18236273lbo.4.1395104715315; Mon, 17 Mar 2014 18:05:15 -0700 (PDT) MIME-Version: 1.0 Sender: yohgaki@gmail.com Received: by 10.112.205.73 with HTTP; Mon, 17 Mar 2014 18:04:35 -0700 (PDT) In-Reply-To: <9E3AA302-1EC1-4497-996F-716555CAAB64@rouvenwessling.de> References: <9E3AA302-1EC1-4497-996F-716555CAAB64@rouvenwessling.de> Date: Tue, 18 Mar 2014 10:04:35 +0900 X-Google-Sender-Auth: oY3YJEzdF7PP-KoxN52NHPrP3Ss Message-ID: To: =?UTF-8?Q?Rouven_We=C3=9Fling?= Cc: PHP internals Content-Type: multipart/alternative; boundary=001a11336c26fb20ec04f4d72063 Subject: Re: [PHP-DEV] [VOTE] Timing attack safe string comparison function From: yohgaki@ohgaki.net (Yasuo Ohgaki) --001a11336c26fb20ec04f4d72063 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable Hi all, On Mon, Feb 3, 2014 at 7:50 AM, Rouven We=C3=9Fling = wrote: > Hi internals, > > as I've received no further feedback I've opened the voting on "Timing > attack safe string comparison function": > > - https://wiki.php.net/rfc/timing_attack > Is there any progress? From benchmark result, overhead for timing safe comparison is negligible with byte by byte comparison. I would like to see timing safe "=3D=3D=3D" for 5.6, if it's possible. (=3D= =3D could be timing safe, too) Is anyone working on it? Regards, -- Yasuo Ohgaki yohgaki@ohgaki.net --001a11336c26fb20ec04f4d72063--