Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:56982
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain managedit.ie designates 209.85.161.170 as permitted sender)
MIME-Version: 1.0
In-Reply-To: <CB176617.204DC%fsb@thefsb.org>
References: <CB176617.204DC%fsb@thefsb.org>
Date: Wed, 21 Dec 2011 17:07:45 +0000
Message-ID: <CAGSj+QunbhxK6RQe75ymSYg5WNON5CCM4D+saogv-Nxv3rqc5A@mail.gmail.com>
To: Tom Worster <fsb@thefsb.org>
Cc: "internals@lists.php.net" <internals@lists.php.net>
Content-Type: multipart/alternative; boundary=14dae9340e0b00df9404b49d394b
Subject: Re: [PHP-DEV] CS random values
From: kiall@managedit.ie (Kiall Mac Innes)

--14dae9340e0b00df9404b49d394b
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable

On Wed, Dec 21, 2011 at 3:31 PM, Tom Worster <fsb@thefsb.org> wrote:
>
> 1. /dev/random and /dev/urandom are unavailable on Windows and
> cannot be fopen()=B9ed in safe mode on *nix/nux

Safe mode has been deprecated for two and a half years.. Adding features to
work around its limitations is (IMO) a bad idea..
Can't argue with it being unavailable on windows..

>
>
> 2. openssl_random_pseudo_bytes() requires openssl extension
> installed and enabled. Most of the popular AMP packages for
> Windows fail on this count. Many shared web hosts don=B9t have it
> either.

As far as I remember, WAMP Server (Arguably the most popular AMP package
for windows) does include openssl support. Its simply disabled by default
like everything else! Some quick googling seems to confirm this..

Some more googling confirms XAMPP also includes OpenSSL out of the box..

>
>
> 3. mcrypt_create_iv() depends on mcrypt extension and so suffers
> similar problems as openssl

mcrypt again comes with both WAMP and XAMPP servers, but disabled by
default.


> 4. Another method is to set runtime config param
> session.entropy_length followed by @session_start();
> session_regenerate_id(); after which session_id() will return a
> CS random string, but this is also foiled by safe mode.

This is obviously not a solution, even if it worked... ;)

>
>
> 5. On Windows you could try COM('CAPICOM.Utilities.1')->GetRandom
> but that API is obsolescent and not in many default Windows
> installs.

I can't speak for windows specific APIs So I'm going to ignore the rest!

It seems that the two preferable cross platform options (openssl and
mcrypt) are already both widely available on all platforms, I'm not sure I
see the need to be honest.

Kiall

--14dae9340e0b00df9404b49d394b--