Re: [RFC] Timing attack safe string comparison function

From: Date: Tue, 24 Dec 2013 06:37:56 +0000
Subject: Re: [RFC] Timing attack safe string comparison function
References: 1 2 3  Groups: php.internals 
Request: Send a blank email to internals+get-70871@lists.php.net to get a copy of this message
Hi all,

On Tue, Dec 24, 2013 at 1:35 PM, Thomas Hruska <thruska@cubiclesoft.com>wrote:

> On 12/23/2013 8:59 PM, Jake A. Smith wrote:
>
>> Hi all,
>>
>>  "strcmp_secure()" or something like this would be good, as it could be
>>>
>>
>> used any security sensitive string comparison.
>>
>> I like that. It makes sense for the function to be named for what it
>> does, not how one hopes or expects it will be used.
>>
>> JS
>>
>
> Perhaps this could be implemented by adding an optional parameter to the
> existing str...cmp() series of functions instead of adding more functions.


We may do this.
However, strcmp() returns 0 for equal strings while strcmp_secure() will
return TRUE for equal strings. We could make strcmp_secure() returns
FALSE/0 for equal strings, but it does not make much sense.

Perhaps, we need different function name rather than strcmp_secure().

I would like to have dedicated functions for security related features, so
that more users aware of issues.

Regards,

--
Yasuo Ohgaki
yohgaki@ohgaki.net


Thread (40 messages)

« previous php.internals (#70871) next »