Re: [RFC] Timing attack safe string comparison function

From: Date: Fri, 27 Dec 2013 21:57:00 +0000
Subject: Re: [RFC] Timing attack safe string comparison function
References: 1 2 3 4 5 6  Groups: php.internals 
Request: Send a blank email to internals+get-70885@lists.php.net to get a copy of this message 
Hi all,

On Sat, Dec 28, 2013 at 3:12 AM, Adam Harvey <aharvey@php.net> wrote:

> > Lastly, please stay away from names like "strcmp_secure()".  5-10
> > years from now such a function will inevitably turn out to be insecure
> > in some way and we'll need to add
> > strcmp_really_secure_I_mean_it_this_time().  That way lies madness.
>
> +1. I don't know what a good name is, but anything with the word
> "secure" isn't it. str_compare_constant_time()?


str_compare_constatnt_time() sounds good name to me.

Regards,

--
Yasuo Ohgaki
yohgaki@ohgaki.net

Thread (40 messages)

« previous php.internals (#70885) next »