Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:112716
MIME-Version: 1.0
References: <CABTDVhA-FvEXdS+A=T5bJnX5YxjseN+ko14GUOqnuA52-omiiw@mail.gmail.com>
In-Reply-To: <CABTDVhA-FvEXdS+A=T5bJnX5YxjseN+ko14GUOqnuA52-omiiw@mail.gmail.com>
Date: Sun, 3 Jan 2021 06:43:52 +0900
Message-ID: <CABTDVhCJsUTEm0gJfLQu2n6i8vUTiCi4XRew8eE4yjeu5L+7iw@mail.gmail.com>
To: internals@lists.php.net
Content-Type: multipart/alternative; boundary="0000000000006758bd05b7f1c185"
Subject: Re: Improving PRNG implementation.
From: zeriyoshi@gmail.com (Go Kudo)

--0000000000006758bd05b7f1c185
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

Unfortunately, there is not much feedback on this proposal.

To remedy the situation, we have updated the RFC and implemented it.

https://wiki.php.net/rfc/object_scope_prng
https://github.com/php/php-src/pull/6568

Currently, it seems to work generally as expected, although it has failed
to be tested on Windows.
However, I am not sure if it is correctly with the new serialize /
unserialize mechanism of PHP. (Of course we've tested the behavior)

2020=E5=B9=B412=E6=9C=8816=E6=97=A5(=E6=B0=B4) 23:46 zeriyoshi <zeriyoshi@g=
mail.com>:

> Nice to meet you, internals.
>
> PHP 8.0 has been released. With the inclusion of JIT, PHP is about to be
> extended beyond the web.
>
> So I'd like to make a few suggestions.
>
> First , PHP has the historical Mersenne Twister PRNG. However, this
> implementation keeps its state in a global and cannot be handled as an
> object like other languages (e.g. Java).
>
> So, I created a PHP Extension and proposed it to PECL.
>
> https://marc.info/?l=3Dpecl-dev&m=3D160795415604102&w=3D2
> https://github.com/zeriyoshi/php-ext-orng
>
> But, Then I looked at the mailing list archives and noticed that a simila=
r
> proposal had been made before.
>
> https://externals.io/message/98021#98130
>
> I feel that this suggestion is needed now to expand PHP beyond the web.
>
> Second suggestion is to stop using the Combined LCG as the default seed
> value for each function.
>
> PHP's Combined LCG only uses PID (or ZTS Thread ID) and time as entropy.
> https://github.com/php/php-src/blob/master/ext/standard/lcg.c#L72
>
> With the development of container technology, this problem seems to be
> getting more serious. So I think we should use the random numbers provide=
d
> by the OS (getrandom on Linux) if available.
>
> I would like to hear your opinions.
>
> Regards
> Go Kudo <zeriyoshi@gmail.com>
>

--0000000000006758bd05b7f1c185--