Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:68604
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.212.174 as permitted sender)
MIME-Version: 1.0
In-Reply-To: <CAPwsocGU5ewAKE4cqX=BFQYqZ65=fAjKfVuQut8H2SDw76UAbg@mail.gmail.com>
References: <CAGa2bXZPkeu0Ns_o2Q4Xe_XM8SqmD8hg9oyjOrbZFS0G1C5t2g@mail.gmail.com>
 <CALtuQzCX-tu7SjZDjM=fW26UXDWoLaKYyZVnX-6DFVj+x3ujyw@mail.gmail.com> <CAPwsocGU5ewAKE4cqX=BFQYqZ65=fAjKfVuQut8H2SDw76UAbg@mail.gmail.com>
Date: Thu, 22 Aug 2013 15:44:01 +0200
Message-ID: <CALtuQzDEJJv_ZAfWpN4heF1Ks6z=4beRR+ayYJ76LQR+DP=LPA@mail.gmail.com>
To: Leigh <leight@gmail.com>
Cc: Yasuo Ohgaki <yohgaki@ohgaki.net>, "internals@lists.php.net" <internals@lists.php.net>
Content-Type: multipart/alternative; boundary=089e01419e8cf4c33d04e4897d85
Subject: Re: [PHP-DEV] Request #65501 uniqid(): More entropy parameter should
 be true by default
From: krebs.seb@gmail.com (Sebastian Krebs)

--089e01419e8cf4c33d04e4897d85
Content-Type: text/plain; charset=ISO-8859-1

2013/8/22 Leigh <leight@gmail.com>

>
> On 22 August 2013 13:39, Sebastian Krebs <krebs.seb@gmail.com> wrote:
>
>> Tbh I don't get the real problem with the _current_ behaviour. Who need
>> the
>> entropy, can set it as second parameter and I am not sure, if it is wise
>> to
>> use uniqid() for _security purposes_.
>>
>
> It's absolutely not wise to use it for anything security related, the
> purpose of the function is simply to provide a unique value within a
> system, not a random value, not an unpredictable value.
>

Thats what was my thought too, but the bugreport states

>  Without more entropy, uniqid() may produce non unique id even if the
name states
> it. This could be security issue under certain cases.


> "more_entropy" in this case might as well be called "higher_resolution".
> As Nikita already pointed out, without this flag set a usleep is performed
> to force function calls to be at least 1 microsecond apart (since the id is
> microtime based). All more_entropy does is add some additional random on
> the end instead of the usleep so when uniqid is called multiple times
> during the same microsecond, the values are still (probably) unique.
>

Wait ... With "more" it is _faster_?! (Havent read Nikitas mail so closely
before...). Definitely something I should remember ^^ My trivial mind would
assume, that the longer output would take more effort.


>
> Making the function return a longer output by default is a BC break imo.
> As already pointed out constrained DB fields will not accept the new
> default, filenames generated using it will no longer conform to a set
> pattern, etc. etc.
>

Worth to mention: The longer output also contains a dot ".", which may lead
to worse things with filenames ;)

Regards,
Sebastian



-- 
github.com/KingCrunch

--089e01419e8cf4c33d04e4897d85--