Re: does this leak more than the size of the string via timing side channels

Er, sorry, I misused the variable names. Obviously I meant
string1.chars... and string2....

On 29 May 2012 17:54, Matthew Kerwin <[e-mail]> wrote:
> I'd suggest something like:
>
> =A0if lengths match:
> =A0 =A0if checksums match:
> =A0 =A0 =A0char-by-char comparison
>
> .. although I can't prove that it doesn't have an equivalent weakness.
> =A0The char-by-char is just in case the two strings have the same
> checksum, obviously.
>
> An alternative could be to transpose the strings from index=3D>char to
> char=3D>[indices], then check that each char's indices are the same for
> both strings:
>
> =A0allc =3D {}
> =A0in1 =3D Hash.new []
> =A0in2 =3D Hash.new []
> =A0in1.chars.each_with_index do |c, i|
> =A0 =A0allc[c] =3D true
> =A0 =A0in1[c] ||=3D []
> =A0 =A0in1[c] << i
> =A0end
> =A0in2.chars.each_with_index do |c, i|
> =A0 =A0allc[c] =3D true
> =A0 =A0in2[c] ||=3D []
> =A0 =A0in2[c] << i
> =A0end
> =A0allc.each do |c|
> =A0 =A0return false if in1[c] !=3D in2[c]
> =A0end
> =A0true
>
> There might be a neater way to write it. And it's much slower, but
> should be more securerer.
>
> --
> =A0 Matthew Kerwin, B.Sc (CompSci) (Hons)
> =A0 http://matthew.kerwin.net.au/
> =A0 ABN: 59-013-727-651
>
> =A0 "You'll never find a programming language that frees
> =A0 you from the burden of clarifying your ideas." - xkcd
>



--=20
=A0 Matthew Kerwin, B.Sc (CompSci) (Hons)
=A0 http://matthew.kerwin.net.au/
=A0 ABN: 59-013-727-651

=A0 "You'll never find a programming language that frees
=A0 you from the burden of clarifying your ideas." - xkcd