Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:112553
MIME-Version: 1.0
References: <CABTDVhA-FvEXdS+A=T5bJnX5YxjseN+ko14GUOqnuA52-omiiw@mail.gmail.com>
In-Reply-To: <CABTDVhA-FvEXdS+A=T5bJnX5YxjseN+ko14GUOqnuA52-omiiw@mail.gmail.com>
Date: Sat, 19 Dec 2020 15:33:29 +0900
Message-ID: <CABTDVhCKu9hjspzs3vv7=9=4C=NhSD9+85e++RhY6wXUwXGc6A@mail.gmail.com>
To: internals@lists.php.net
Content-Type: multipart/alternative; boundary="000000000000d1d86c05b6cb6774"
Subject: Re: Improving PRNG implementation.
From: zeriyoshi@gmail.com (zeriyoshi)

--000000000000d1d86c05b6cb6774
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

On Wed, Dec 16, 2020 at 8:46 AM zeriyoshi <zeriyoshi@gmail.com> wrote:

Hello.

I have created an account on the PHP.net wiki to create an RFC about this.
Can you grant me editing privileges?

As for suggestion two, I sent a PR to php-src on GitHub.
https://github.com/php/php-src/pull/6520

Fortunately, Nikita seems to be checking it out. Thank you very much.

P.S: I had mentioned earlier that php_combined_lcg() was used in the
session, but I checked and it seems not to be the case now. I will correct
it. Sorry about that.

Regards,
Go Kudo

2020=E5=B9=B412=E6=9C=8816=E6=97=A5(=E6=B0=B4) 23:46 zeriyoshi <zeriyoshi@g=
mail.com>:

> Nice to meet you, internals.
>
> PHP 8.0 has been released. With the inclusion of JIT, PHP is about to be
> extended beyond the web.
>
> So I'd like to make a few suggestions.
>
> First , PHP has the historical Mersenne Twister PRNG. However, this
> implementation keeps its state in a global and cannot be handled as an
> object like other languages (e.g. Java).
>
> So, I created a PHP Extension and proposed it to PECL.
>
> https://marc.info/?l=3Dpecl-dev&m=3D160795415604102&w=3D2
> https://github.com/zeriyoshi/php-ext-orng
>
> But, Then I looked at the mailing list archives and noticed that a simila=
r
> proposal had been made before.
>
> https://externals.io/message/98021#98130
>
> I feel that this suggestion is needed now to expand PHP beyond the web.
>
> Second suggestion is to stop using the Combined LCG as the default seed
> value for each function.
>
> PHP's Combined LCG only uses PID (or ZTS Thread ID) and time as entropy.
> https://github.com/php/php-src/blob/master/ext/standard/lcg.c#L72
>
> With the development of container technology, this problem seems to be
> getting more serious. So I think we should use the random numbers provide=
d
> by the OS (getrandom on Linux) if available.
>
> I would like to hear your opinions.
>
> Regards
> Go Kudo <zeriyoshi@gmail.com>
>

--000000000000d1d86c05b6cb6774--