Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:118303
MIME-Version: 1.0
References: <CABTDVhC4J8WuKj4SdVK6hbZX2k7qrPDVCQ2g1Yb_4k4Hf5MEQQ@mail.gmail.com>
 <aa395f78-aebe-d52c-a419-aa0effeb64df@bastelstu.be> <CABTDVhDC6K37N6E_wJxzyrqSX2RsPL-OryW6BOOApUD2W_e94Q@mail.gmail.com>
 <CAEKnhAF4XsF6y98roSGtCmFn7K+cak2hXDYsbk8KVuqXXEwtOQ@mail.gmail.com> <CABTDVhCmnEJCMZRLKrJA45LHnY6a1dHV0F17PSvpp20W_N0WoQ@mail.gmail.com>
In-Reply-To: <CABTDVhCmnEJCMZRLKrJA45LHnY6a1dHV0F17PSvpp20W_N0WoQ@mail.gmail.com>
Date: Mon, 25 Jul 2022 11:42:51 -0500
Message-ID: <CAESVnVpq+cJUNLd-8KOGurvL7JZspVyDtxvEDtyiTPFSXMfYbw@mail.gmail.com>
To: Go Kudo <zeriyoshi@gmail.com>
Cc: Jakub Zelenka <bukka@php.net>, PHP internals <internals@lists.php.net>
Content-Type: multipart/alternative; boundary="0000000000008ce44b05e4a3e015"
Subject: Re: [PHP-DEV] What do you think CSPRNG in PHP
From: pollita@php.net (Sara Golemon)

--0000000000008ce44b05e4a3e015
Content-Type: text/plain; charset="UTF-8"

On Mon, Jul 25, 2022 at 7:08 AM Go Kudo <zeriyoshi@gmail.com> wrote:
> Indeed, But ext-openssl is not always available.
> To use it in a ext-session, etc., it must be bundled reliably.
>

Which means that users can generally call `random_bytes()/random_int()` for
an always available, but maybe not most performant CSPRNG source, or if
they need those extra cycles, they can make sure OpenSSL is installed and
available and call that API instead.

Library authors can even abstract this away using function_exists() and a
graceful fallback to random_int().  I think it's okay to trust developers
to know how to program well, and to learn when they don't.

-Sara

--0000000000008ce44b05e4a3e015--