Hi all,
On Sat, Feb 8, 2014 at 8:06 AM, Pádraic Brady <[email protected]>wrote:
> Timing attacks are practical. It's been proven. It's accepted as a
> security vulnerability (albeit grudgingly I know by those who have to
> fix it). It's been fixed in any number of applications already. We
> could wait for a hostile attack to actually happen and then actually
> be publicised, but why do nothing when the fix is so damn simple? :P
>
I agree. It's easy to fix by PHP core. There are number of real apps that
have deployed
mitigation by themselves. There is no reason not to add counter measure for
timing attacks.
It's mandatory as language. We may make ==/=== timing safe like Python, it
may be overkill
or may not.
Have anyone took benchmark with this?
https://github.com/yohgaki/php-src/compare/PHP-5.6-rfc-hash-compare
There are number of timing safe comparison functions.
BTW, I would like to see comparison between current PHP hash and
xxhash/SipHash for
PHP array. IIRC, PHP is using BJB's old hash. Other languages adopted
SipHash, I think
it worth to try or have it already done?
Regards,
--
Yasuo Ohgaki
[email protected]