4 ms·
Good point. Is there are library of constant time functions for security sensitive applications to replace the standard ones in libc? (Seems like the kind of th
by pja 11y ago
Good point. Is there are library of constant time functions for security sensitive applications to replace the standard ones in libc? (Seems like the kind of thing that the OpenBSD people might have written.)
strcmp() is at least better than a buggy equivalent that doesn’t actually work :)
- SCHiM 11y agoThe idea is to use constant time hashing functions, and then compare the hashes instead of comparing the strings themselves. AFAIK there is no implementation of the C stdlib that makes sure no timing attacks can be performed.