Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:118349
MIME-Version: 1.0
References: <157e4f6b6e96376e61194b9a358c87b02880ec28.camel@sandfox.me> <67f9981b-de29-2f83-cecf-08ea3c1199ae@bastelstu.be>
In-Reply-To: <67f9981b-de29-2f83-cecf-08ea3c1199ae@bastelstu.be>
Date: Thu, 4 Aug 2022 22:32:40 +0200
Message-ID: <CAJmy8YEGzTnr9=XxUTkWU9fcBOzs1x-dXNov1ks-EzfcQoUXtQ@mail.gmail.com>
To: =?UTF-8?Q?Tim_D=C3=BCsterhus?= <tim@bastelstu.be>
Cc: Anton Smirnov <sandfox@sandfox.me>, PHP Internals List <internals@lists.php.net>, 
	Go Kudo <zeriyoshi@gmail.com>
Content-Type: multipart/alternative; boundary="0000000000006ff5eb05e5704252"
Subject: Re: [PHP-DEV] xoshiro** edge case (all zeros)
From: divinity76@gmail.com (Hans Henrik Bergan)

--0000000000006ff5eb05e5704252
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

dangerous to be sure, but it's also a technically valid seed,
are you sure we should disallow a valid seed?

On Thu, 4 Aug 2022 at 20:33, Tim D=C3=BCsterhus <tim@bastelstu.be> wrote:

> Hi
>
> On 8/4/22 10:09, Anton Smirnov wrote:
> > xoshiro** has a known edge case: all-zero seed
>
> Indeed, good catch. I had that in mind, but forgot about it.
>
> > <?php
> >
> > $engine =3D new \Random\Engine\Xoshiro256StarStar(str_repeat("\0", 32))=
;
> >
> > while (true) {
> >      echo hex2bin($engine->generate()), PHP_EOL; // 0000000000000000
> > }
> >
> > It should be documented and/or handled
> >
> > It's only for a string seed, int seed is not affected
> >
>
> I've created a PR here:
>
> https://github.com/php/php-src/pull/9250
>
> I've opted to throw a ValueError in that case, as that's the only safe
> option that does not introduce a bias.
>
> The 32xNUL seed basically should only happen for manually written
> testing input and not happen otherwise. An actual random seed will
> result in 32 NUL bytes with just a 2**-256 chance and when relying on
> the implicit CSPRNG seeding (`null` as seed parameter) my PR will just
> retry to catch even that edge case.
>
> Best regards
> Tim D=C3=BCsterhus
>
> --
> PHP Internals - PHP Runtime Development Mailing List
> To unsubscribe, visit: https://www.php.net/unsub.php
>
>

--0000000000006ff5eb05e5704252--