Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:73268
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain rouvenwessling.de designates 5.35.242.46 as permitted sender)
Content-Type: text/plain; charset=iso-8859-1
Mime-Version: 1.0 (Mac OS X Mail 7.2 \(1874\))
In-Reply-To: <CAGa2bXbPA_LPT85XpNj8G=ivYw+ynZf_LuuFLt7t2MDU1hXx2w@mail.gmail.com>
Date: Tue, 18 Mar 2014 12:23:25 +0100
Cc: PHP internals <internals@lists.php.net>
Content-Transfer-Encoding: quoted-printable
Message-ID: <4403BF54-041A-42F7-8B93-16EC3B2B0F43@rouvenwessling.de>
References: <9E3AA302-1EC1-4497-996F-716555CAAB64@rouvenwessling.de> <CAGa2bXbPA_LPT85XpNj8G=ivYw+ynZf_LuuFLt7t2MDU1hXx2w@mail.gmail.com>
To: Yasuo Ohgaki <yohgaki@ohgaki.net>
Subject: Re: [PHP-DEV] [VOTE] Timing attack safe string comparison function
From: me@rouvenwessling.de (=?iso-8859-1?Q?Rouven_We=DFling?=)


On 18.03.2014, at 02:04, Yasuo Ohgaki <yohgaki@ohgaki.net> wrote:

> On Mon, Feb 3, 2014 at 7:50 AM, Rouven We=DFling =
<me@rouvenwessling.de> wrote:
>=20
>> Hi internals,
>>=20
>> as I've received no further feedback I've opened the voting on =
"Timing
>> attack safe string comparison function":
>>=20
>> - https://wiki.php.net/rfc/timing_attack
>>=20
>=20
> Is there any progress?

The pull request (https://github.com/php/php-src/pull/608) for that RFC =
is waiting to be merged, I hope someone gets to it before beta1.

> =46rom benchmark result, overhead for timing safe comparison is =
negligible
> with byte by byte comparison.
> I would like to see timing safe "=3D=3D=3D" for 5.6, if it's possible. =
(=3D=3D could
> be timing safe, too)
>=20
> Is anyone working on it?

I don't know if someone else is, but I am not.

Best regards
Rouven=