Introduction of timing attack safe bcmp implementation. #4729
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
staabm
reviewed
Sep 20, 2019
devnexen
force-pushed
the
safe_bcmp_intro
branch
2 times, most recently
from
49969b0 to
b7106eb
Compare
devnexen
force-pushed
the
safe_bcmp_intro
branch
from
6e5ef96 to
78a51c1
Compare
|
Would it make sense to add the length check (both strings must have same length) to Anyway, could you please resolve the merge conflicts? |
|
Sure I can give it a try |
devnexen
force-pushed
the
safe_bcmp_intro
branch
2 times, most recently
from
757af67 to
955eaee
Compare
|
This looks reasonable to me (not sure about adding a new file for that). More review welcome! |
|
What's the status of this PR? Still waiting for review? Can we get this into master for 8.2? |
|
ping :-) |
Girgias
approved these changes
Jun 20, 2022
| @@ -179,6 +179,10 @@ END_EXTERN_C() | |||
| #define explicit_bzero php_explicit_bzero | |||
| #endif | |||
|
|
|||
| BEGIN_EXTERN_C() | |||
| PHPAPI int php_safe_bcmp(const zend_string *a, const zend_string *b); | |||
There was a problem hiding this comment.
maybe add a comment either here to indicate that -1 is if the strings do not have the same lengths, 0 if they match and 1 if they are not equal?
Nothing new but to refactor usage b/w hash and password extensions but using volatile pointers to be a bit safer, allowing to expand its usage eventually.
devnexen
force-pushed
the
safe_bcmp_intro
branch
from
e79fb0e to
a76882b
Compare
|
Closed by bfe6f9e66 |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Nothing new but to refactor usage b/w hash and password
extensions but using volatile pointers to be a bit safer,
allowing to expand its usage eventually.