Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:120461
Message-ID: <5ca4e382-8284-1cd0-696f-0dfd693523f8@bastelstu.be>
Date: Tue, 30 May 2023 18:03:44 +0200
MIME-Version: 1.0
Content-Language: en-US
To: internals@lists.php.net
References: <CAH5C8xWAsRV+8h-tZ2Xq0=tn753kbSQX=KSEYsE2fWEtQVMrew@mail.gmail.com>
 <CAMs36HfmXuUJWJ0uih+Pj_vui4wG4vy3OTMmmspGmpP9h_gvgw@mail.gmail.com>
 <9ea3a5af-679d-ad63-f9c2-e0d8d148db3f@bastelstu.be>
 <CABTDVhDPLwBHDDzfXcHhs4VZNMHswWqum9muKgZcA63sgMCZdg@mail.gmail.com>
In-Reply-To: <CABTDVhDPLwBHDDzfXcHhs4VZNMHswWqum9muKgZcA63sgMCZdg@mail.gmail.com>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 8bit
Subject: Re: [PHP-DEV] [RFC] [Discussion] PHP 8.3 deprecations
From: tim@bastelstu.be (=?UTF-8?Q?Tim_D=c3=bcsterhus?=)

Hi

On 5/30/23 17:52, Go Kudo wrote:
>   > It should be deprecated with PHP 8.4 at the earliest to give folks at
> least
> 
> Indeed, I agree that `lcg_value()` should be deprecated at least in PHP 8.4.
> 
> However, `lcg_value()` remains a dangerous function. It still has a weak
> initial seeding problem (PID, time), not to mention global state. This is
> extremely dangerous for workloads on containers where PIDs tend to be
> fixed. Perhaps this should be documented at the time of PHP 8.3 release.

As the function is not seedable in userland, we do not need to preserve 
a specific sequence or behavior. Therefore it should be possible to 
replace the seeding to make use of the CSPRNG and fall back to the old 
and insecure seeding if the CSPRNG fails.

For the same reason, the global state is also less of a problem compared 
to mt_rand() and friends.

> Because of the above, I have removed my `lcg_value()` deprecation entry
> from the RFC. Thanks!
Thanks!

Best regards
Tim Düsterhus