Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:91858
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain paragonie.com designates 209.85.218.53 as permitted sender)
MIME-Version: 1.0
Date: Tue, 22 Mar 2016 14:29:09 -0400
Message-ID: <CAKws9z1bY=nLo=K8D9OQ_K0yhfNE-5SAEaDgyZnM34P3v8im9g@mail.gmail.com>
To: PHP Internals <internals@lists.php.net>
Content-Type: multipart/alternative; boundary=001a1140919aa8de35052ea7639b
Subject: [RFC] RFC4648 encoding
From: scott@paragonie.com (Scott Arciszewski)

--001a1140919aa8de35052ea7639b
Content-Type: text/plain; charset=UTF-8

PHP already offers bin2hex()/hex2bin() and base64_encode()/base64_decode().
This covers part, but not all, of RFC 4648.

I'd like to extend the coverage to include, at minimum, Base32.

I'd also like to make these functions to be written to resist cache-timing
attacks (i.e. when used to encode/decode encryption keys for long-term
storage). Userland PoC: https://github.com/paragonie/constant_time_encoding

http://blog.ircmaxell.com/2014/11/its-all-about-time.html

These modifications can either be made in-place (at a negligble cost on the
scale of nanoseconds) or they can be an alternative implementation. i.e.

    * bin2hex_ts()
    * base64_encode_ts()
    * base32_encode_ts()

Does anyone have any questions or concerns?

Scott Arciszewski
Chief Development Officer
Paragon Initiative Enterprises <https://paragonie.com>

--001a1140919aa8de35052ea7639b--