Bug#765893: streql - Constant-time string comparison

2014-10-30 Thread Riley Baird
If your only concern is if the strings are equal, or which is the shortest, then I agree that constant-time evaluation would not be important to you. For that reason, you probably wouldn't need streql; you could just use the built-in functions. On 30/10/14 14:44, Leslie S Satenstein wrote: > Here

Bug#765893: streql - Constant-time string comparison

2014-10-29 Thread Joel Rees
On Thu, Oct 30, 2014 at 4:58 AM, Riley Baird wrote: > On 29/10/14 19:55, Richard van den Berg wrote: >> On 28-10-14 20:59 , Riley Baird wrote: >>> As far as I can tell, your code ensures that even if the strings are of >>> different length, an equality calculation should be performed anyway, >>> h

Bug#765893: streql - Constant-time string comparison

2014-10-29 Thread Riley Baird
On 30/10/14 01:34, Leslie S Satenstein wrote: > Hi Riley > > Suppose the strings are 10k bytes each (10240), but they differ at byte zero, > where is the break instruction to stop the compare? Why would there need to be a break instruction? That would mean that the time taken to compare strings

Bug#765893: streql - Constant-time string comparison

2014-10-29 Thread Riley Baird
On 29/10/14 19:55, Richard van den Berg wrote: > On 28-10-14 20:59 , Riley Baird wrote: >> As far as I can tell, your code ensures that even if the strings are of >> different length, an equality calculation should be performed anyway, >> however returning 0, on the grounds that this would make it

Bug#765893: streql - Constant-time string comparison

2014-10-29 Thread Riley Baird
On 29/10/14 17:00, Joel Rees wrote: > 2014/10/29 4:59 "Riley Baird" < > bm-2cvqnduybau5do2dfjtrn7zbaj246s4...@bitmessage.ch>: >> >> On 29/10/14 00:20, Joel Rees wrote: >>> On Tue, Oct 28, 2014 at 12:08 PM, Riley Baird >>> wrote: Dear debian-security, I am looking for a sponsor for m