Re: [RFC] Timing attack safe string comparison function

From: Date: Tue, 24 Dec 2013 04:35:15 +0000
Subject: Re: [RFC] Timing attack safe string comparison function
References: 1 2  Groups: php.internals 
Request: Send a blank email to internals+get-70869@lists.php.net to get a copy of this message 
On 12/23/2013 8:59 PM, Jake A. Smith wrote:

Hi all,


"strcmp_secure()" or something like this would be good, as it could be


used any security sensitive string comparison.

I like that. It makes sense for the function to be named for what it does, not how one hopes or expects it will be used.

JS


Perhaps this could be implemented by adding an optional parameter to the existing str...cmp() series of functions instead of adding more functions.

-- 
Thomas Hruska
CubicleSoft President

I've got great, time saving software that you might find useful.

http://cubiclesoft.com/

Thread (40 messages)

« previous php.internals (#70869) next »