How do you implement and verify Cryptographic Signatures (HMAC-SHA256) with timing attack prevention in PHP?

Real-World Scenario / Incident Description

An attacker forged webhook authentication payloads because the signature check used standard `==` string comparison instead of `hash_equals()`.

718 views • Updated 1 month ago

Timing Attacks & Constant-Time String Comparison

Standard string comparisons (===) fail fast at the first differing byte. An attacker measuring millisecond response timing can deduce character by character.

$computedSignature = hash_hmac('sha256', $rawPayload, $secretKey);

// VULNERABLE to timing attacks:
// if ($computedSignature === $incomingSignature) { ... }

// SECURE constant-time verification:
if (! hash_equals($computedSignature, $incomingSignature)) {
    throw new SecurityException("Invalid webhook signature.");
}

Related Concepts: #Security #Cryptography #Timing Attack #HMAC #hash_equals

More Modern PHP 8.x & Internals Interview Questions

How does the Zend Engine manage memory with Zvals, Reference Counting, and the Circular Garbage Collector in PHP 8.x? Read → Explain PHP 8.4 Asymmetric Visibility, Property Hooks, and Constructor Property Promotion. Read → How does the JIT (Just-In-Time) compiler in PHP 8.x work, and why does it benefit CPU-heavy tasks but not typical database-heavy web apps? Read → How do PHP Fibers work under the hood, and how do they differ from full async threads (Go Goroutines / Node.js Event Loop)? Read → How do you stream and parse a 50GB JSON/CSV export file in PHP without exceeding a 128MB memory limit? Read →

Back to Modern PHP 8.x & Internals Questions