Re: [RFC] Timing attack safe string comparison function

From: Date: Tue, 24 Dec 2013 08:28:36 +0000
Subject: Re: [RFC] Timing attack safe string comparison function
References: 1 2 3 4  Groups: php.internals 
Request: Send a blank email to internals+get-70872@lists.php.net to get a copy of this message 
On 12/23/2013 11:37 PM, Yasuo Ohgaki wrote:

Hi all,

On Tue, Dec 24, 2013 at 1:35 PM, Thomas Hruska <thruska@cubiclesoft.com>wrote:


On 12/23/2013 8:59 PM, Jake A. Smith wrote:


Hi all,

  "strcmp_secure()" or something like this would be good, as it could be




used any security sensitive string comparison.

I like that. It makes sense for the function to be named for what it
does, not how one hopes or expects it will be used.

JS



Perhaps this could be implemented by adding an optional parameter to the
existing str...cmp() series of functions instead of adding more functions.



We may do this.
However, strcmp() returns 0 for equal strings while strcmp_secure() will
return TRUE for equal strings. We could make strcmp_secure() returns
FALSE/0 for equal strings, but it does not make much sense.


Ah, good point.  It was just an idea that crossed my mind and I'll admit that I had not thought that far ahead.  Having the documentation for the return value of strcmp() change to "mixed" would indeed be odd if it returns boolean results for the "secure" version but integer results otherwise.

-- 
Thomas Hruska
CubicleSoft President

I've got great, time saving software that you might find useful.

http://cubiclesoft.com/

Thread (40 messages)

« previous php.internals (#70872) next »