Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:81012
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 74.125.82.50 as permitted sender)
MIME-Version: 1.0
Sender: kobrasrealm@gmail.com
Date: Thu, 22 Jan 2015 20:37:12 -0500
Message-ID: <CAPKwhws-TLdo2_QUwunn6cGZg4sotHKooJboTSqONULGBasbyQ@mail.gmail.com>
To: "inter >> PHP internals" <internals@lists.php.net>
Content-Type: multipart/alternative; boundary=047d7b87501cebd28f050d47d364
Subject: Identify timing-safe function candidates
From: scott@arciszewski.me (Scott Arciszewski)

--047d7b87501cebd28f050d47d364
Content-Type: text/plain; charset=UTF-8

As per the conversation on this Pull Request
https://github.com/php/php-src/pull/909#issuecomment-71077928

What functions are involved in real world PHP applications (frameworks,
popular CMSes, etc) that operate on encoded encryption keys that might
benefit from having a timing-safe implementation?

So far, I can identify:

- bin2hex()
- hex2bin()
- base64_encode()
- base64_decode()
- json_encode()
- json_decode()
- parse_ini_file()

I think it would be great to compile a master list of which functions are
commonly used to store long-term encryption keys (random bytes that could
cause parse errors).

Also, would it be better to use a prefix (e.g. ts_*), a class with static
methods (e.g. TimingSafe::bin2hex()), or functions in a namespace (e.g.
\TimingSafe\bin2hex())?

Scott

P.S. At this point, I'm also withdrawing my participation of this
discussion. If you don't think it's worthwhile to fix this, that's your
decision. I've had some major life events happen and I no longer have time
to debate this. Thanks for understanding.

--047d7b87501cebd28f050d47d364--