Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:62533
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 74.125.82.170 as permitted sender)
MIME-Version: 1.0
Sender: yohgaki@gmail.com
In-Reply-To: <5039E4FA.6060102@sugarcrm.com>
References: <CAJRMtAGcN-n9wv8-CFiLt+bXhMvOcmfG8a3kBORVUVCz9n4Bqw@mail.gmail.com>
 <50364644.1060302@lerdorf.com> <CAJRMtAH=-B8+M6+kMrpKQZ=Yg2ASa5iv=JCUbjvHkw0UFmw73w@mail.gmail.com>
 <CAL+t6cHj4p=RLwSRGX789w-CswZQd_XtuL364KRBsc66ROdmJA@mail.gmail.com>
 <CAGa2bXY2+kDx32evFmFqUD3P1L6x=PypnVJTuj_mP2853QWQKw@mail.gmail.com>
 <CAH-PCH6d_sO7he5VMTO+d+YPSk5ZmYXpNd8wDmZ4pW9qTjxzrA@mail.gmail.com>
 <CAGa2bXaXx4T3AB46k9mmJFiw=5qJbHnphxeHjx=i1_THrrY05A@mail.gmail.com> <5039E4FA.6060102@sugarcrm.com>
Date: Mon, 27 Aug 2012 05:49:20 +0900
Message-ID: <CAGa2bXaekEwu75jyHMd_S=51XjXRvMRAR+2Vg8YoYFW6j0ViSQ@mail.gmail.com>
To: Stas Malyshev <smalyshev@sugarcrm.com>
Cc: Ferenc Kovacs <tyra3l@gmail.com>, Sherif Ramadan <theanomaly.is@gmail.com>, 
	PHP Internals <internals@lists.php.net>
Content-Type: text/plain; charset=ISO-8859-1
Subject: Re: [PHP-DEV] Session Id Collisions
From: yohgaki@ohgaki.net (Yasuo Ohgaki)

Hi,

2012/8/26 Stas Malyshev <smalyshev@sugarcrm.com>:
> Hi!
>
>> I know session ID collision will not happen most likely, but
>> there are few people who worries collision. We can check
>> session ID collision when it is generated.
>
> You mean two randomly generated session IDs colliding? I think the
> probability of it is pretty low. I mean it'd take PHP's random number
> generator function to generate two equal random numbers in the same
> microsecond. And these are random 64-bit numbers, so unless you're
> generating billions of sessions per microsecond I don't think it's a
> very real concern.

Right,

Statistically, session ID collision will not happen.
It's very low even when we consider birthday paradox.
We could also use stronger hash (SHA-1 etc) rather than MD5.

However, collision detection is easy and makes collision impossible.
That's the whole point of the patch. Collision is most unlikely, but
unique session ID the basis of security. It's worth to have, IMHO.

Regards,

--
Yasuo Ohgaki
yohgaki@ohgaki.net