Skip to content

Update secure_tools.rst #4787

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
wants to merge 3 commits into from
Closed

Update secure_tools.rst #4787

Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
b11dbe7
Update secure_tools.rst
dunglas Jan 6, 2015
4181947
Better wording
dunglas Mar 11, 2015
89a553a
Other CS fixes
dunglas Mar 12, 2015
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
18 changes: 12 additions & 6 deletions components/security/secure_tools.rst
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,22 +9,28 @@ Comparing Strings
~~~~~~~~~~~~~~~~~

The time it takes to compare two strings depends on their differences. This
can be used by an attacker when the two strings represent a password for
instance; it is known as a `Timing attack`_.
can be used by an attacker when the two strings represent a hash of a password
for instance; it is known as a `Timing attack`_.

Internally, when comparing two passwords, Symfony uses a constant-time
algorithm; you can use the same strategy in your own code thanks to the
:class:`Symfony\\Component\\Security\\Core\\Util\\StringUtils` class::

use Symfony\Component\Security\Core\Util\StringUtils;

// is some known string (e.g. password) equal to some user input?
$bool = StringUtils::equals($knownString, $userInput);
// is some known string (e.g. password hash) equal to another string
// (e.g. hash ofsome user input)?
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

looks like a typo here: "ofsome" should probably be "of some"

$bool = StringUtils::equals($knownString, $anotherString);

.. caution::

To avoid timing attacks, the known string must be the first argument
and the user-entered string the second.
Both arguments must be of the same length to be compared successfully. When
arguments of differing length are supplied, `false` can be returned immediately and
the length of the known string may be leaked in case of a timing attack.
The known string must be the first argument and the string based on the user-entered
content the second.
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

If you want this to be rendered as a newline, you need to add a blank line after this.

This method is more reliable with PHP 5.6 and superior because it internally uses
the native :phpfunction:`hash_equals <hash_equals>` PHP function.

Generating a Secure random Number
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Expand Down