Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:62424
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: error (pb1.pair.com: domain lerdorf.com from 209.85.220.170 cause and error)
Message-ID: <50364644.1060302@lerdorf.com>
Date: Thu, 23 Aug 2012 08:03:32 -0700
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:14.0) Gecko/20120714 Thunderbird/14.0
MIME-Version: 1.0
To: Raymond Irving <xwisdom@gmail.com>
CC: PHP Internals <internals@lists.php.net>
References: <CAJRMtAGcN-n9wv8-CFiLt+bXhMvOcmfG8a3kBORVUVCz9n4Bqw@mail.gmail.com>
In-Reply-To: <CAJRMtAGcN-n9wv8-CFiLt+bXhMvOcmfG8a3kBORVUVCz9n4Bqw@mail.gmail.com>
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit
Subject: Re: [PHP-DEV] Session Id Collisions
From: rasmus@lerdorf.com (Rasmus Lerdorf)

On 08/22/2012 09:48 PM, Raymond Irving wrote:
> Hello Everyone,
> 
> I've been reading that it's possible to encounter session id collisions
> with the default php configuration. It's also been said that PHP utilizes a
> cryptographically weak random number generator to
> produce session ID information.
> 
> 
> I know it's possible to change the hash function and entropy used in the
> generation of the id but after looking at the php_session_create_id()
> function  in the source code, I am wondering if adding the User Agent
> string to the default setup would improve the uniqueness of the id.
> 
> What do you think?

Adding a widely-known string adds very little entropy. As of PHP 5.4 we
default to using session.entropy_file set to /dev/urandom or /dev/random
(if it is available) so there is no entropy issue with the default
config as of 5.4. Before 5.4 users had to be aware enough to add that to
their php.ini themselves.

-Rasmus