PHP RFC: Timing Safe Encoding Functions


Cryptography libraries written in PHP often store encryption keys in an alternate encoding (Base-16 or Base-64, as specified in RFC 4648). However, the way these functions are trivially implemented open the door to possible cache-timing attacks which could be used to steal encryption keys, even if the encryption is well-implemented.


A number of functions that already exist will have a timing-safe alternative exposed to PHP developers.

  • bin2hex() → bin2hex_ts()
  • hex2bin() → hex2bin_ts()
  • base64_encode() → base64_encode_ts()
  • base64_decode() → base64_decode_ts()

Backward Incompatible Changes

None! :)

Proposed PHP Version(s)

This proposal targets the 7.0 release of PHP. Or 7.1 if it's too late.

Proposed Voting Choices

As this is not a significant change, a 50%+1 majority vote ought to be sufficient.

Patches and Tests

An incomplete patch is being developed in Pull Request 1036.


rfc/timing_safe_encoding.txt · Last modified: 2017/09/22 13:28 (external edit)