Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:112616
MIME-Version: 1.0
References: <CABTDVhA-FvEXdS+A=T5bJnX5YxjseN+ko14GUOqnuA52-omiiw@mail.gmail.com>
In-Reply-To: <CABTDVhA-FvEXdS+A=T5bJnX5YxjseN+ko14GUOqnuA52-omiiw@mail.gmail.com>
Date: Fri, 25 Dec 2020 01:11:37 +0900
Message-ID: <CABTDVhAYjCiZKGPJw6nMVHYp6wmVeqFzE+bK2Q3WzXW=9EV7ew@mail.gmail.com>
To: internals@lists.php.net
Content-Type: multipart/alternative; boundary="000000000000a0d29805b73810a3"
Subject: Re: Improving PRNG implementation.
From: zeriyoshi@gmail.com (zeriyoshi)

--000000000000a0d29805b73810a3
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

I updated the RFC draft and changed it to a proposal to bifurcate the
interface.

https://wiki.php.net/rfc/object_scope_prng

At the same time, I was looking into the RNG problem in Swoole and found
out that the problem was actually occurring.

https://www.easyswoole.com/En/Other/random.html

The above problem with Swoole is only for child processes and can be fixed
by the user, but as mentioned above, I think it will become more serious as
PHP becomes more complex in the future.
I hadn't thought of this before, but we might want to consider deprecating
existing state-dependent RNG functions.

I am seeking feedback on this proposal in order to take the RFC to the next
step.
Thank you in advance.

Regards,
Go Kudo

2020=E5=B9=B412=E6=9C=8816=E6=97=A5(=E6=B0=B4) 23:46 zeriyoshi <zeriyoshi@g=
mail.com>:

> Nice to meet you, internals.
>
> PHP 8.0 has been released. With the inclusion of JIT, PHP is about to be
> extended beyond the web.
>
> So I'd like to make a few suggestions.
>
> First , PHP has the historical Mersenne Twister PRNG. However, this
> implementation keeps its state in a global and cannot be handled as an
> object like other languages (e.g. Java).
>
> So, I created a PHP Extension and proposed it to PECL.
>
> https://marc.info/?l=3Dpecl-dev&m=3D160795415604102&w=3D2
> https://github.com/zeriyoshi/php-ext-orng
>
> But, Then I looked at the mailing list archives and noticed that a simila=
r
> proposal had been made before.
>
> https://externals.io/message/98021#98130
>
> I feel that this suggestion is needed now to expand PHP beyond the web.
>
> Second suggestion is to stop using the Combined LCG as the default seed
> value for each function.
>
> PHP's Combined LCG only uses PID (or ZTS Thread ID) and time as entropy.
> https://github.com/php/php-src/blob/master/ext/standard/lcg.c#L72
>
> With the development of container technology, this problem seems to be
> getting more serious. So I think we should use the random numbers provide=
d
> by the OS (getrandom on Linux) if available.
>
> I would like to hear your opinions.
>
> Regards
> Go Kudo <zeriyoshi@gmail.com>
>

--000000000000a0d29805b73810a3--