Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:71974
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.217.173 as permitted sender)
MIME-Version: 1.0
Sender: yohgaki@gmail.com
Date: Sun, 2 Feb 2014 13:32:21 +0900
Message-ID: <CAGa2bXbq1ttBz+hSk20-CkKWvDdHr5+8bBmc04Q22i7K2VSs+A@mail.gmail.com>
To: "internals@lists.php.net" <internals@lists.php.net>
Content-Type: multipart/alternative; boundary=001a11c3648608700b04f164e781
Subject: Extending uniqid() or not?
From: yohgaki@ohgaki.net (Yasuo Ohgaki)

--001a11c3648608700b04f164e781
Content-Type: text/plain; charset=UTF-8

Hi all,

uniqid() is producing unique ID for the system which is good for email's
message ID etc. Many users are using uniqid() as secure unique ID which is
very bad thing to do for security.

It may be extend to produce safe unique ID

 string uniqid(TRUE) - Returns random ID string which is safe to use
security purposes.

My concern is that uniqid() return both safe and unsafe ID which may not be
good. We may better to have new function, perhaps

 string safe_uniqid([ing $length=64])

It generate ID using good RNG such as /dev/urandom, /dev/arandom for
UNIXes, openssl RNG for Windows when they are available. It does not use
hash function, but simply convert RNG binary data into text. The same
algorithm that is used for session ID may be used. (Use
hash_bits_per_character=5, since it only contains alphanumeric chars) Since
it does not use hash, it's fast.

We might be better to use hash even if it's a little slow. This
implementation is affected by RNG vulnerabilities directly

The new function name could be anything,

Too many API is not good, but confusing API is not good also.

Any comments? Any good names?

Regards,


P.S. Is anyone working UUID? PostgreSQL is using OSSP's UUID lib, it's good
for PHP.
http://www.postgresql.org/docs/9.2/interactive/uuid-ossp.html

--
Yasuo Ohgaki
yohgaki@ohgaki.net

--001a11c3648608700b04f164e781--