Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:91963
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.220.47 as permitted sender)
To: Scott Arciszewski <scott@paragonie.com>,
 PHP Internals <internals@lists.php.net>
References: <CAKws9z1bY=nLo=K8D9OQ_K0yhfNE-5SAEaDgyZnM34P3v8im9g@mail.gmail.com>
Message-ID: <56F7398A.5050002@gmail.com>
Date: Sat, 26 Mar 2016 18:38:18 -0700
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:38.0)
 Gecko/20100101 Thunderbird/38.7.1
MIME-Version: 1.0
In-Reply-To: <CAKws9z1bY=nLo=K8D9OQ_K0yhfNE-5SAEaDgyZnM34P3v8im9g@mail.gmail.com>
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: 7bit
Subject: Re: [PHP-DEV] [RFC] RFC4648 encoding
From: smalyshev@gmail.com (Stanislav Malyshev)

Hi!

> PHP already offers bin2hex()/hex2bin() and base64_encode()/base64_decode().
> This covers part, but not all, of RFC 4648.
> 
> I'd like to extend the coverage to include, at minimum, Base32.

What's the use case for it? Is anybody using base32 now?

> I'd also like to make these functions to be written to resist cache-timing
> attacks (i.e. when used to encode/decode encryption keys for long-term
> storage). Userland PoC: https://github.com/paragonie/constant_time_encoding
> These modifications can either be made in-place (at a negligble cost on the
> scale of nanoseconds) or they can be an alternative implementation. i.e.

What modification needs to be done for existing one? Since encoding
functions (unlike comparison ones) have to process every bit anyway, so
what are timing differences for e.g. base64? Is there any existing
research for this?

> 
>     * bin2hex_ts()
>     * base64_encode_ts()
>     * base32_encode_ts()

If you have encode functions, you should have decode too? Otherwise,
you'd have the same issue every time the key is read.

-- 
Stas Malyshev
smalyshev@gmail.com