Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:61302
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 74.125.83.42 as permitted sender)
MIME-Version: 1.0
Date: Mon, 16 Jul 2012 15:54:47 +0200
Message-ID: <CAF+90c9c-LuEzXyWJYfkQ5ycNYYRTqBB+0NhZDEkhGeQQaeEpw@mail.gmail.com>
To: PHP internals <internals@lists.php.net>
Content-Type: text/plain; charset=ISO-8859-1
Subject: =?ISO-8859-1?Q?Random_string_generation_=28=E1_la_password=5Fmake=5Fsalt=29?=
From: nikita.ppv@gmail.com (Nikita Popov)

Hi all,

I just want to throw a quick thought in here:

The password API proposal includes a function called
password_make_salt(), that basically creates a random string, either
in raw binary form, or in the bcrypt salt format. Personally I don't
see much use for the function in the salt context as the password API
already generates the salt all by itself, but I do see a lot of use
for a random string function in general. People commonly want to
create random strings according to some format. Like CSRF tokens, ids,
etc.

So my thought was to drop password_make_salt() and instead add some
kind of generalized random_string() function:

    // this is a 20 byte random binary string
    $str = random_string(20);

    // ten random hex characters
    $str = random_string(10, "0123456789ABCDEF");

    // 15 characters from the bcrypt alphabet 0-9a-zA-Z./
    $str = random_string(15,
"0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ./");

    // if it's not too hard to implement, one could support this kind
of shortcut:
    $str = random_string(15, "0-9a-zA-Z./");

Thoughts?

Nikita