Re: [RFC] Timing attack safe string comparison function

From: Date: Mon, 23 Dec 2013 09:09:06 +0000
Subject: Re: [RFC] Timing attack safe string comparison function
References: 1  Groups: php.internals 
Request: Send a blank email to internals+get-70847@lists.php.net to get a copy of this message 
On 12/22/2013 05:08 PM, Rouven Weßling wrote:

Hi internals,

I'd like to propose this RFC to introduce a time-constant string comparison function: https://wiki.php.net/rfc/timing_attack

I will not open the voting before January 7 to account for holidays.

Best regards
Rouven



Morning,

	This does not appear to solve any problems, it appears to add another function, for that function to solve any problems it must be deployed.
	So the RFC relies on everyone swapping out every security sensitive string comparison with the new function, which simply will not happen.

	I'm up for doing something about security, however, this doesn't actually do that, what it does is add a (generically named) function that nobody is very likely to deploy, and doesn't fix the vulnerability in existing code ... which surely has to be the aim of anything targeted at security - existing code.

	Obviously, we cannot really change all string comparisons to use security sensitive logic, so this isn't something we can really solve everywhere from the core, some action must be taken by the user ...

	It might have more traction if the function were named password_compare or hash_compare or something similar that gives everyone the idea that it is not simply a string comparison function but the correct way to verify in particular passwords/hashes or whatever. I'd be much more inclined to say that's a good idea, providing a full set of tools for password related foo.

Cheers
Joe

Thread (40 messages)

« previous php.internals (#70847) next »