Re: [VOTE] Timing attack safe string comparison function

From:	Yasuo Ohgaki	Date:	Thu, 06 Feb 2014 23:05:05 +0000
Subject:	Re: [VOTE] Timing attack safe string comparison function
References:	1	Groups:	php.internals
Request:	Send a blank email to [email protected] to get a copy of this message

Hi Rouven,

I made SipHash version of str_compare() as a sample.
There is timing safe php_compare(), which is stolen from BSD.

https://github.com/yohgaki/php-src/compare/PHP-5.6-rfc-hash-compare

[yohgaki@dev github-php-src]$ ./php-bin -r 'var_dump(str_compare("abc",
"abc"));'
bool(true)
[yohgaki@dev github-php-src]$ ./php-bin -r 'var_dump(str_compare("asfasdf",
"slkjojoeiwrj"));'
bool(false)

It's quick patch made less than 30 min.
So it can be improved, I suppose.

Regards,

--
Yasuo Ohgaki
[email protected]


   

Thread (54 messages)

• Rouven WeßlingSun, 02 Feb 2014 22:50:21 +0000
  • Yasuo OhgakiMon, 03 Feb 2014 01:48:35 +0000
  • Joe WatkinsMon, 03 Feb 2014 07:07:09 +0000Re: [VOTE] Timing attack safe string comparison function
  • Andrea FauldsMon, 03 Feb 2014 12:23:53 +0000
    • Sara GolemonMon, 03 Feb 2014 16:21:25 +0000
  • Sara GolemonMon, 03 Feb 2014 16:18:49 +0000
    • Yasuo OhgakiWed, 05 Feb 2014 02:39:06 +0000
  • Nikita PopovMon, 03 Feb 2014 17:10:05 +0000
    • Pádraic BradyMon, 03 Feb 2014 19:58:21 +0000
    • Yasuo OhgakiMon, 03 Feb 2014 20:57:13 +0000
      • Yasuo OhgakiMon, 03 Feb 2014 21:04:35 +0000
    • Stas MalyshevMon, 03 Feb 2014 22:09:32 +0000
      • Yasuo OhgakiTue, 04 Feb 2014 04:06:30 +0000
        • Yasuo OhgakiTue, 04 Feb 2014 04:30:06 +0000
        • Yasuo OhgakiWed, 05 Feb 2014 02:58:42 +0000
          • Rouven WeßlingWed, 05 Feb 2014 23:36:44 +0000
            • Yasuo OhgakiThu, 06 Feb 2014 01:28:38 +0000
              • Yasuo OhgakiThu, 06 Feb 2014 03:56:11 +0000
                • Yasuo OhgakiThu, 06 Feb 2014 04:20:55 +0000
                  • Yasuo OhgakiThu, 06 Feb 2014 04:31:17 +0000
                    • Yasuo OhgakiThu, 06 Feb 2014 05:17:18 +0000
                • Christopher JonesThu, 06 Feb 2014 04:23:23 +0000
                  • Pierre JoyeThu, 06 Feb 2014 05:24:53 +0000
                    • Stas MalyshevThu, 06 Feb 2014 07:01:36 +0000
                      • Pierre JoyeThu, 06 Feb 2014 07:09:06 +0000
    • Tjerk MeestersTue, 04 Feb 2014 06:20:37 +0000
  • Yasuo OhgakiThu, 06 Feb 2014 23:05:05 +0000
    • Yasuo OhgakiFri, 07 Feb 2014 01:39:31 +0000
      • Yasuo OhgakiMon, 10 Feb 2014 00:24:25 +0000
        • Yasuo OhgakiMon, 10 Feb 2014 01:15:25 +0000
          • Yasuo OhgakiMon, 10 Feb 2014 01:37:58 +0000
          • Yasuo OhgakiMon, 10 Feb 2014 01:58:00 +0000
          • Tjerk MeestersMon, 10 Feb 2014 09:29:31 +0000
            • Pádraic BradyMon, 10 Feb 2014 12:39:26 +0000
        • Lester CaineMon, 10 Feb 2014 09:03:07 +0000
          • Yasuo OhgakiWed, 12 Feb 2014 07:01:35 +0000
            • Lester CaineWed, 12 Feb 2014 07:24:16 +0000
              • Yasuo OhgakiWed, 12 Feb 2014 08:11:21 +0000
  • Rouven WeßlingSun, 23 Feb 2014 15:11:21 +0000
    • Rouven WeßlingSun, 23 Feb 2014 18:31:38 +0000
      • Yasuo OhgakiSun, 23 Feb 2014 20:59:09 +0000
        • Rouven WeßlingSun, 23 Feb 2014 21:05:43 +0000
          • Yasuo OhgakiMon, 24 Feb 2014 04:22:00 +0000
            • Lester CaineMon, 24 Feb 2014 08:11:06 +0000
              • Yasuo OhgakiMon, 24 Feb 2014 09:00:24 +0000
  • Yasuo OhgakiTue, 18 Mar 2014 01:04:35 +0000
    • Rouven WeßlingTue, 18 Mar 2014 11:23:25 +0000
      • Adam HarveyTue, 18 Mar 2014 16:13:33 +0000
        • Ferenc KovacsTue, 18 Mar 2014 18:56:47 +0000
          • Yasuo OhgakiWed, 19 Mar 2014 00:27:57 +0000
            • Ferenc KovacsWed, 19 Mar 2014 02:31:38 +0000
• Andrey AndreevWed, 05 Feb 2014 20:18:17 +0000Re: [VOTE] Timing attack safe string comparison function
• Andrey AndreevMon, 24 Feb 2014 08:13:35 +0000Re: [VOTE] Timing attack safe string comparison function
  • Tjerk MeestersMon, 24 Feb 2014 11:25:58 +0000