2 ms·
That was a quick copy/paste. But imagine the loop would be the string we know (i.e. the password). Looping through the 10-character pass should be identical ev
by umsm 12y ago
That was a quick copy/paste.
But imagine the loop would be the string we know (i.e. the password). Looping through the 10-character pass should be identical every time, regardless of what the user entered.
- totony 12y agoI imagine the strlen() function is not constant-timed, so I'd remove it, but it might work yes (but you'd have to check PHP's source code and have a deep understanding of it to really be sure).
- mappu 12y agolibc `strlen()` is O(n), but PHP strings are binary safe (i.e. http://3v4l.org/47iaP http://3v4l.org/47iaP ) so it must be storing a length as part of the string zval. So PHP strlen should be constant time. +1 for recommending checking the PHP source code to be sure, though
- TazeTSchnitzel 12y agostrlen() in PHP is constant-time O(1), we don't use C strings. (Well, we do, but we store length information and reference count them) See: http://lxr.php.net/xref/PHP_TRUNK/Zend/zend_builtin_functions.c#524 http://lxr.php.net/xref/PHP_TRUNK/Zend/zend_builtin_function...