Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:91868
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.213.50 as permitted sender)
MIME-Version: 1.0
Sender: yohgaki@gmail.com
In-Reply-To: <CAKws9z1bY=nLo=K8D9OQ_K0yhfNE-5SAEaDgyZnM34P3v8im9g@mail.gmail.com>
References: <CAKws9z1bY=nLo=K8D9OQ_K0yhfNE-5SAEaDgyZnM34P3v8im9g@mail.gmail.com>
Date: Wed, 23 Mar 2016 04:35:01 +0900
Message-ID: <CAGa2bXb6UU0mHh6SfEMRJR=EeTNhKBKkMFYoVz07zO-q3r5mEA@mail.gmail.com>
To: Scott Arciszewski <scott@paragonie.com>
Cc: PHP Internals <internals@lists.php.net>
Content-Type: text/plain; charset=UTF-8
Subject: Re: [PHP-DEV] [RFC] RFC4648 encoding
From: yohgaki@ohgaki.net (Yasuo Ohgaki)

Hi Scott,

On Wed, Mar 23, 2016 at 3:29 AM, Scott Arciszewski <scott@paragonie.com> wrote:
> PHP already offers bin2hex()/hex2bin() and base64_encode()/base64_decode().
> This covers part, but not all, of RFC 4648.
>
> I'd like to extend the coverage to include, at minimum, Base32.
>
> I'd also like to make these functions to be written to resist cache-timing
> attacks (i.e. when used to encode/decode encryption keys for long-term
> storage). Userland PoC: https://github.com/paragonie/constant_time_encoding
>
> http://blog.ircmaxell.com/2014/11/its-all-about-time.html
>
> These modifications can either be made in-place (at a negligble cost on the
> scale of nanoseconds) or they can be an alternative implementation. i.e.
>
>     * bin2hex_ts()
>     * base64_encode_ts()
>     * base32_encode_ts()
>
> Does anyone have any questions or concerns?

Sounds good to me and I would like to see these in next release.

Regards,

--
Yasuo Ohgaki
yohgaki@ohgaki.net