Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:91965
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain paragonie.com designates 209.85.214.172 as permitted sender)
MIME-Version: 1.0
In-Reply-To: <56F7398A.5050002@gmail.com>
References: <CAKws9z1bY=nLo=K8D9OQ_K0yhfNE-5SAEaDgyZnM34P3v8im9g@mail.gmail.com>
	<56F7398A.5050002@gmail.com>
Date: Sat, 26 Mar 2016 21:56:55 -0400
Message-ID: <CAKws9z2_LU1o6peYJWtDWvtQPE4nin6ChZPMG5=xWQSf7ikKtA@mail.gmail.com>
To: Stanislav Malyshev <smalyshev@gmail.com>
Cc: PHP Internals <internals@lists.php.net>
Content-Type: multipart/alternative; boundary=089e011602f85b6ca8052efe1c68
Subject: Re: [PHP-DEV] [RFC] RFC4648 encoding
From: scott@paragonie.com (Scott Arciszewski)

--089e011602f85b6ca8052efe1c68
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

On Sat, Mar 26, 2016 at 9:38 PM, Stanislav Malyshev <smalyshev@gmail.com>
wrote:

> Hi!
>
> > PHP already offers bin2hex()/hex2bin() and
> base64_encode()/base64_decode().
> > This covers part, but not all, of RFC 4648.
> >
> > I'd like to extend the coverage to include, at minimum, Base32.
>
> What's the use case for it? Is anybody using base32 now?
>
> > I'd also like to make these functions to be written to resist
> cache-timing
> > attacks (i.e. when used to encode/decode encryption keys for long-term
> > storage). Userland PoC:
> https://github.com/paragonie/constant_time_encoding
> > These modifications can either be made in-place (at a negligble cost on
> the
> > scale of nanoseconds) or they can be an alternative implementation. i.e=
.
>
> What modification needs to be done for existing one? Since encoding
> functions (unlike comparison ones) have to process every bit anyway, so
> what are timing differences for e.g. base64? Is there any existing
> research for this?
>
> >
> >     * bin2hex_ts()
> >     * base64_encode_ts()
> >     * base32_encode_ts()
>
> If you have encode functions, you should have decode too? Otherwise,
> you'd have the same issue every time the key is read.
>
> --
> Stas Malyshev
> smalyshev@gmail.com
>

=E2=80=8BGoogle Authenticator and Tor Hidden Services both use base32. I wa=
s also
going to cover the decoding functions in the RFC.=E2=80=8B

Scott Arciszewski
Chief Development Officer
Paragon Initiative Enterprises <https://paragonie.com/>=E2=80=8B

--089e011602f85b6ca8052efe1c68--