Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:68822
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.215.53 as permitted sender)
MIME-Version: 1.0
In-Reply-To: <CAEKnhAGUbCfFeX8HMOSOtK=jUuV7Ho2yOe1ftnaxD5Ttc5J9PQ@mail.gmail.com>
References: <521E64B6.30703@marc-bennewitz.de>
	<521F37E5.5040203@gmail.com>
	<CAGa2bXbcEZDUwmvTWdp3E73oytjSbLyYT7YA+E=KBQt5UAv-AA@mail.gmail.com>
	<5220F973.5000000@marc-bennewitz.de>
	<001701cea5e7$e872d030$b9587090$@org>
	<CAEKnhAGUbCfFeX8HMOSOtK=jUuV7Ho2yOe1ftnaxD5Ttc5J9PQ@mail.gmail.com>
Date: Mon, 2 Sep 2013 00:01:18 +0200
Message-ID: <CAEZPtU6_gGCDj3VvHQEhGRKMm_ic=JL58EM8ZNVLP-JTAhne1A@mail.gmail.com>
To: Jakub Zelenka <bukka@php.net>
Cc: "Bryan C. Geraghty" <bryan@ravensight.org>, Marc Bennewitz <php@marc-bennewitz.de>, 
	PHP internals list <internals@lists.php.net>
Content-Type: text/plain; charset=ISO-8859-1
Subject: Re: [PHP-DEV] More powerful (and backward compatible) API of random
 number generator functions
From: pierre.php@gmail.com (Pierre Joye)

On Sun, Sep 1, 2013 at 3:12 PM, Jakub Zelenka <bukka@php.net> wrote:

> The whole proposal is a bit confusing for me. The combination of PRNG
> algorithm (MT) with libraries (libc, OpenSSL, GMP) that implements one or
> more PRNG algorithms just doesn't make sense to me. It doesn't say anything
> about the speed and crypto strength of the algorithms. I think that much
> better solution would be an extension that implements a couple of
> algorithms. Then you could select what algorithm you want to use. The good
> idea would be to have some reasonable default algorithm that would be used
> if the user doesn't know anything about algorithms. This could be
> implemented as an extension and if it's good enough then it could be
> proposed as the core addition.

Except a few very well known algorithm (MT, SIMD MT and the likes)
with well tested implementation, I would not even try to implement
anything else on our own, even less for crypto safe algorithms. This
is something really hard to implement and I know very little new
algorithm or new implementations actually working as expected, and
they were done by experts, not people like you and me :)

Relying on well tested libraries or devices (harware like those
avaiable in the new haswel serie,  /dev/*random, etc.) is a much
better approach and let us focus on the APIs we will provide in the
userland side.

Cheers,
--
Pierre

@pierrejoye |  http://www.libgd.org