php 한글 메뉴얼 도움말 검색 사이트 Timing attack safe string comparison [function.hash-equals]

설명

bool hash_equals ( string $known_string , string $user_string )

Compares two strings using the same time whether they're equal or not.

This function should be used to mitigate timing attacks; for instance, when testing crypt() password hashes.

인수

known_string: The string of known length to compare against
user_string: The user-supplied string

반환값

Returns TRUE when the two strings are equal, FALSE otherwise.

오류/예외

Emits an E_WARNING message when either of the supplied parameters is not a string.

예제

Example #1 example


<?php
$expected  = crypt('12345', '$2a$07$usesomesillystringforsalt$');
$correct   = crypt('12345', '$2a$07$usesomesillystringforsalt$');
$incorrect = crypt('apple',  '$2a$07$usesomesillystringforsalt$');

var_dump(hash_equals($expected, $correct));
var_dump(hash_equals($expected, $incorrect));
?>

위 예제의 출력:

bool(true)
bool(false)

주의

Note:
Both arguments must be of the same length to be compared successfully. When arguments of differing length are supplied, FALSE is returned immediately and the length of the known string may be leaked in case of a timing attack.

Note:
It is important to provide the user-supplied string as the second parameter, rather than the first.