Re: [VOTE] Timing attack safe string comparison function

From: Date: Mon, 10 Feb 2014 01:37:58 +0000
Subject: Re: [VOTE] Timing attack safe string comparison function
References: 1 2 3 4 5  Groups: php.internals 
Request: Send a blank email to [email protected] to get a copy of this message
Hi Dmitry,

On Mon, Feb 10, 2014 at 10:15 AM, Yasuo Ohgaki <[email protected]> wrote:

> str_word_compare     Elapsed: 1.337508   Iterations: 1000000 DataSize: 128
> str_compare          Elapsed: 1.194582   Iterations: 1000000 DataSize: 128
>
> str_word_compare() is the winner for relatively large data.
>

It seems the difference is marginal. It may be better to make ==/=== string
comparison timing safe by default if php_word_compare() implementation
does not have timing issue.

Patch for php_word_compare() is
https://github.com/yohgaki/php-src/commit/302a53db87c93b469fb85041e8c505207e3a6d9c

What do you think?

Regards,

P.S.
xxhash32 is surprisingly fast, but it has limited hash space. Therefore,
it's not a good idea to use it for string comparison. IIRC or if it did not
changed, Zend uses old DJB hash. It may be good idea to use xxhash
for PHP array.

--
Yasuo Ohgaki
[email protected]


Thread (54 messages)

« previous php.internals (#72424) next »