Consider switching to paragonie/constant_time_encoding

[larowlan]

Q	A
Bug report?	no
Feature request?	yes
BC Break report?	no
RFC? / Specification	no
Library version	8.3.x, 9.x

The base 32 encoding library used by this project doesn't claim to protect against timing attacks.

It uses substr and strlen, which as per http://blog.ircmaxell.com/2014/11/its-all-about-time.html are not timing safe.

https://github.com/paragonie/constant_time_encoding is designed to prevent timing attacks

If you're interested in this change, could poke at it some.

[Spomky]

Hi @larowlan,

This is a very interesting report. I will change both v8 and v9 branches in favor of this dependency.
As it is easier to bruteforce a n digits code, I am not sure there is a potential security issue at the moment, but that is a risk that I do not want to take.

Thanks.

[larowlan]

Thanks, let me know if you want help, happy to work on it if you're in support of the change

[Spomky]

Done for both v8.3 and v9.0 branches.

Minimal versions to use are:

• ^8.3.2
• ^9.0.2

Thanks for the report.