Re: [RFC] Timing attack safe string comparison function

From: Date: Sat, 28 Dec 2013 00:02:53 +0000
Subject: Re: [RFC] Timing attack safe string comparison function
References: 1 2 3 4 5 6 7  Groups: php.internals 
Request: Send a blank email to internals+get-70889@lists.php.net to get a copy of this message
On Fri, Dec 27, 2013 at 3:57 PM, Yasuo Ohgaki <yohgaki@ohgaki.net> wrote:

> Hi all,
>
> On Sat, Dec 28, 2013 at 3:12 AM, Adam Harvey <aharvey@php.net> wrote:
>
> > > Lastly, please stay away from names like "strcmp_secure()".  5-10
> > > years from now such a function will inevitably turn out to be insecure
> > > in some way and we'll need to add
> > > strcmp_really_secure_I_mean_it_this_time().  That way lies madness.
> >
> > +1. I don't know what a good name is, but anything with the word
> > "secure" isn't it. str_compare_constant_time()?
>
>
> str_compare_constatnt_time() sounds good name to me.
>
> Regards,
>
> --
> Yasuo Ohgaki
> yohgaki@ohgaki.net
>

I had to chuckle at strcmp_really_secure_I_mean_it_this_time(). I agree
though, calling it secure is a bad idea.

Rather than str_compare_constant_time() would it be better to call it
strcmp_constant_time() to keep things consistent?

JS

-- 
Jake A. Smith | @jakeasmith


Thread (40 messages)

« previous php.internals (#70889) next »