Fixed security floor in hash_equals

[GrahamCampbell]

Fixed security floor. Always better to rely on a third party secure implementation rather than maintaining a separate one that just recently was noticed to be broken.

[GrahamCampbell]

I propose a new patch release is tagged asap after this PR.

[GrahamCampbell]

I then propose we remove this extra public method we have here.

[odino]

I think at this point we can even remove the timingSafeEquals method

[odino]

this will also drop compatibility with 5.5 -- not that Im against it :)

let me know once its finalized and we can release a new major version

[GrahamCampbell]

I think at this point we can even remove the timingSafeEquals method

Only if we do a minor version bump. I'd rather we patched this issue in a patch release, then removed the method.

[GrahamCampbell]

let me know once its finalized and we can release a new major version

You mean minor?

[odino]

I mean major, as hash_equals doesnt seem to be avilable pre-5.6? Or am I missing something?

[GrahamCampbell]

I mean major, as hash_equals doesnt seem to be avilable pre-5.6? Or am I missing something?

We don't need to drop php 5.5 support. That dependency I added makes that function available on php 5.5.

[GrahamCampbell]

I mean major, as hash_equals doesnt seem to be avilable pre-5.6? Or am I missing something?

If you're following semver, only minor releases are needed during 0.x to make BC breaking changes. I see no reason for you to need to bump from 0.6 to 1.0?

[GrahamCampbell]

Oh, wait, I missread what version we were on, lol.

[odino]

Oh, didnt realize you added the symfony polyfill -- will merge and tag!