Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:80243
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.215.48 as permitted sender)
MIME-Version: 1.0
In-Reply-To: <CAOv1iQYUW6N4SMmVQqxsSBVpePe8OzOwgo1D35uFNB2PzSigHQ@mail.gmail.com>
References: <CAOv1iQYUW6N4SMmVQqxsSBVpePe8OzOwgo1D35uFNB2PzSigHQ@mail.gmail.com>
Date: Tue, 6 Jan 2015 23:54:32 +0100
Message-ID: <CAOv1iQb4a3+aXFs1A1JHGQ0BAzHheejaMWhgNT8ELbr5qMxquw@mail.gmail.com>
To: PHP Internals <internals@lists.php.net>
Content-Type: multipart/alternative; boundary=001a11c36c06e3d79a050c03b12c
Subject: Re: hash_equals: leak less information about length
From: dunglas@gmail.com (=?UTF-8?Q?K=C3=A9vin_Dunglas?=)

--001a11c36c06e3d79a050c03b12c
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

Hello internals,

I've submitted this PR a long time ago:
https://github.com/php/php-src/pull/792

I still think it's a good idea to mitigate the length leak (rather than
returning immediately if strings are not of the same length) while
advertising in docs that the length will leak in any case.

php.net doc has been fixed, but - for instance - this is not the case of
the Symfony doc:
http://symfony.com/doc/current/components/security/secure_tools.html (this
method internally use hash_equals, I've just submitted a PR to fix this doc
but I'm sure there is a lot of other misuses in the wild).

To summarize: a theoretical (especially for web apps, more annoying for CLI
apps) and advertised leak is better than a big undocumented leak. Can you
merge this PR?

2014-08-31 12:59 GMT+02:00 K=C3=A9vin Dunglas <dunglas@gmail.com>:

> Hi,
>
> I've submitted a PR to make the hash_equals function leak less informatio=
n
> about compared strings' lengths (benchmark and use cases available in
> comments): https://github.com/php/php-src/pull/792
>
> Trying to hide length is needed to replace Symfony and Joomla PHP
> implementations by hash_equals (when available).
>
> The idea:
> - clearly advert in the documentation that this function can potentially
> leak lengths
> - Try to make it harder for an attacker by using a robuster implementatio=
n.
>
> If there there is an agreement to use this kind of implementation, I'll
> rework the PR to use some tricks from the CPython one (
> https://github.com/python/cpython/blob/c7688b44387d116522ff53c0927169db45=
969f0e/Modules/_operator.c#L175
> - use of volatile and no modulo).
>
> Best regards,
> --
> K=C3=A9vin Dunglas
>
> http://dunglas.fr
>



--=20
K=C3=A9vin Dunglas
Consultant et d=C3=A9veloppeur freelance

http://dunglas.fr
T=C3=A9l. : 06 60 91 20 20

--001a11c36c06e3d79a050c03b12c--