7 ms·
You should never be doing a string compare on the exact string sent over the network anyway. You should be hashing it first. Hashing destroys any value in knowi
by tlb 14y ago
You should never be doing a string compare on the exact string sent over the network anyway. You should be hashing it first. Hashing destroys any value in knowing how much of the substring you matched.
- tptacek 14y agoI'm not sure there's much of a security difference between secure compare functions and hashing, but it's worth knowing about that technique too; do whatever you're most confident in implementing.
- tedunangst 14y agoIf you hash the user session cookie before looking it up in your database, it has the minor advantage that in the event your cookie database is stolen, it's worthless.
- biot 14y agoIf you know how much of the substring of the hash matches, you could use a timing attack to construct a hash collision.
- tedunangst 14y agoNot really. The hash is going to change too much. Let's say you know the first digits of a hash are "ABCDEF". It's significant work to find something that hashes to that. And now you have to generate a whole bunch of them to guess the seventh letter.