Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:123832
Message-ID: <ff3be800-761f-47bf-be02-737e00246c84@bastelstu.be>
Date: Tue, 25 Jun 2024 19:58:37 +0200
Precedence: bulk
MIME-Version: 1.0
Subject: Re: [PHP-DEV] [RFC] Deprecations for PHP 8.4
To: "Rowan Tommins [IMSoP]" <imsop.php@rwec.co.uk>, internals@lists.php.net
References: <bw20I5b7ly3lSbI-2Bv3kfrfTVJbDo5RhwBiQa1PEwuLjprDJWptPajLiaialj1RLVKu7z1j0MofJUhhRVtzT_5i2E11oKeQx_VMUxnKhUE=@gpb.moe>
 <CADyq6sLuz3430TRMu8cSh5_x57UBaWA8v4sr_c+OgUSjn-otBQ@mail.gmail.com>
 <b922b56a-b0e0-454b-a1ec-6f981f66795a@rwec.co.uk>
Content-Language: en-US
In-Reply-To: <b922b56a-b0e0-454b-a1ec-6f981f66795a@rwec.co.uk>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 8bit
From: tim@bastelstu.be (=?UTF-8?Q?Tim_D=C3=BCsterhus?=)

Hi

On 6/25/24 18:03, Rowan Tommins [IMSoP] wrote:
> Then again, if you _actually_ want it to be unique, rather than random,
> those aren't the right replacements anyway.

They are for all intents and purposes if the generated string is long 
enough. By the pigeonhole principle you can't guarantee uniqueness for a 
fixed-length string, but when you have 128 bits of entropy you are 
statistically all but guaranteed to receive a unique string. I've made 
an example calculation for the "session.sid_length and 
session.sid_bits_per_character" bit of this very RFC.

The replacement I suggested to Marco `bin2hex(random_bytes(16))` does 
use exactly 128 bits (16 bytes) of secure randomness for that reason.

For Randomizer::getBytesFromString() you can calculate the entropy as 
follows:

     var_dump(log(strlen($string) ** $length, 2));

You can calculate the minimum length to have 128 bits of entropy for a 
given alphabet string as follows:

     var_dump(ceil(log(2**128, strlen($string))));

For some example alphabets, the minimum length for 128 bits of entropy 
would be:

- [0-9]      : 39
- [0-9a-f]   : 32
- [a-z]      : 28
- [a-z0-9]   : 25
- [a-zA-Z]   : 23
- [a-zA-Z0-9]: 22

Best regards
Tim Düsterhus