Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:103414
MIME-Version: 1.0
References: <CALYT1Yohs0fL_nfHzsSuhpT=4-69e-N3oAJdeW0NO64E9ma6GQ@mail.gmail.com>
 <1D2D9809-6A2D-49E5-9F86-FBB52AF538B5@thefsb.org> <CALYT1Yr_HqT4jBaRL77SOiU+NvPKrabmDC2DqoGgCb=fzYc38w@mail.gmail.com>
 <BBE4CDAF-7EB1-464B-98D5-F539EBA7A75C@thefsb.org>
In-Reply-To: <BBE4CDAF-7EB1-464B-98D5-F539EBA7A75C@thefsb.org>
Date: Wed, 31 Oct 2018 13:55:03 -0400
Message-ID: <CALYT1YqHA5Kif0kHTior1Ap=TiSTTNQcKUB2RJBH00_pYaTqsQ@mail.gmail.com>
To: Tom Worster <fsb@thefsb.org>
Cc: PHP Internals <internals@lists.php.net>
Content-Type: text/plain; charset="UTF-8"
Subject: Re: [RFC] Improve openssl_random_pseudo_bytes()
From: me@sammyk.me (Sammy Kaye Powers)

Hey Tom!

> According to one argument that has a lot of currency, it does.

You have great points that I totally agree with; after all, my
original proposal was to alias to random_bytes(). But this RFC just
targets the implementation problems, not the OpenSSL CSPRNG itself. We
already discussed in a separate thread the possibility of
removing/aliasing it, but have decided we're gonna keep it. :)

> (Btw, "a proper CSPRNG" might be misinterpreted as a **bold** claim.

Good point - I'm not an infosec expert by any means so I try to avoid
making any hard claims regarding cryptography. :)

> Idk. It's your RFC and I kinda hijacked the thread.

Hehe - thanks for hijacking! I always love the feedback. :)

Thanks,
Sammy Kaye Powers
sammyk.me