Cover of the book Symfony 5: The Fast Track

Symfony 5: The Fast Track is the best book to learn modern Symfony development, from zero to production. +300 pages showcasing Symfony with Docker, APIs, queues & async tasks, Webpack, SPAs, etc.

  1. Home
  2. Documentation
  3. Components
  4. Security
  5. Securely Comparing Strings and Generating Random Numbers
WARNING: You are browsing the documentation for Symfony 2.5 which is not maintained anymore. Consider upgrading your projects to Symfony 5.1.

Securely Comparing Strings and Generating Random Numbers

2.5 version
Maintained
3.4 4.4 5.1 current 5.2 dev
Unmaintained
2.3 2.5 2.6 2.7 2.8 3.0 3.1 3.2 3.3 4.0 4.1 4.2 4.3 5.0

Securely Comparing Strings and Generating Random Numbers

The Symfony Security component comes with a collection of nice utilities related to security. These utilities are used by Symfony, but you should also use them if you want to solve the problem they address.

Comparing Strings

The time it takes to compare two strings depends on their differences. This can be used by an attacker when the two strings represent a password for instance; it is known as a Timing attack.

Internally, when comparing two passwords, Symfony uses a constant-time algorithm; you can use the same strategy in your own code thanks to the Symfony\Component\Security\Core\Util\StringUtils class:

use Symfony\Component\Security\Core\Util\StringUtils;

// is some known string (e.g. password) equal to some user input?
$bool = StringUtils::equals($knownString, $userInput);

Caution

To avoid timing attacks, the known string must be the first argument and the user-entered string the second.

Generating a Secure random Number

Whenever you need to generate a secure random number, you are highly encouraged to use the Symfony Symfony\Component\Security\Core\Util\SecureRandom class:

use Symfony\Component\Security\Core\Util\SecureRandom;

$generator = new SecureRandom();
$random = $generator->nextBytes(10);

The nextBytes() method returns a random string composed of the number of characters passed as an argument (10 in the above example).

The SecureRandom class works better when OpenSSL is installed. But when it’s not available, it falls back to an internal algorithm, which needs a seed file to work correctly. Just pass a file name to enable it:

use Symfony\Component\Security\Core\Util\SecureRandom;

$generator = new SecureRandom('/some/path/to/store/the/seed.txt');
$random = $generator->nextBytes(10);

Note

If you’re using the Symfony Framework, you can access a secure random instance directly from the container: its name is security.secure_random.

This work, including the code samples, is licensed under a Creative Commons BY-SA 3.0 license.