Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:103332
MIME-Version: 1.0
References: <CALYT1YoC4Us2Hwh+MGfBaUrx7CQ32krVBQ2M2xs414WTMC8veQ@mail.gmail.com>
In-Reply-To: <CALYT1YoC4Us2Hwh+MGfBaUrx7CQ32krVBQ2M2xs414WTMC8veQ@mail.gmail.com>
Date: Fri, 19 Oct 2018 07:29:19 +0200
Message-ID: <CAJW__o2muOdrr7EpnWUPANxye0JA5AgJPzj8bmyOb97bGyqhgw@mail.gmail.com>
To: Sammy Kaye Powers <me@sammyk.me>
Cc: Internals <internals@lists.php.net>
Content-Type: text/plain; charset="UTF-8"
Subject: Re: [PHP-DEV] Alias openssl_random_pseudo_bytes() to php_random_bytes_throw()
From: kalle@php.net (Kalle Sommer Nielsen)

Hi Sammy

Den fre. 19. okt. 2018 kl. 02.38 skrev Sammy Kaye Powers <me@sammyk.me>:
> 4) We get to consolidate our CSPRNG code in one place. This would make
> it nice to be able to upgrade all the CSPRNG code to libsodium's
> CSPRNG if we choose to in the future for example.

I would prefer this, any instead of making it an alias or something,
then just straight down deprecate it instead seems like a more
flawless option to me.

> The change I'm proposing would be to:
>
> 1) Make openssl_random_pseudo_bytes() return bytes from
> php_random_bytes_throw() causing the function to fail closed and never
> returning false.
> 2) Deprecate the usage of the second pass-by-reference parameter and
> remove in PHP 8.0. Until then, it always sets the value to true.
>
> Do you think this kind of change would warrant an RFC?

It would.



-- 
regards,

Kalle Sommer Nielsen
kalle@php.net