Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:71989
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.216.171 as permitted sender)
MIME-Version: 1.0
In-Reply-To: <CAGa2bXYJRUP58x_XSHgXBy0L0Yiprw=UP-suspWtVqkvYHKC2g@mail.gmail.com>
References: <CAGa2bXbq1ttBz+hSk20-CkKWvDdHr5+8bBmc04Q22i7K2VSs+A@mail.gmail.com>
	<52EDF552.4010208@divbyzero.net>
	<CAGa2bXYJRUP58x_XSHgXBy0L0Yiprw=UP-suspWtVqkvYHKC2g@mail.gmail.com>
Date: Sun, 2 Feb 2014 11:27:27 +0100
Message-ID: <CAEZPtU54PQkK-m-O2Zxa2nu0hz4JBMSRjNX_1HcSQ16oeMyLOQ@mail.gmail.com>
To: Yasuo Ohgaki <yohgaki@ohgaki.net>
Cc: Martin Jansen <martin@divbyzero.net>, 
	"internals@lists.php.net" <internals@lists.php.net>
Content-Type: text/plain; charset=UTF-8
Subject: Re: [PHP-DEV] Extending uniqid() or not?
From: pierre.php@gmail.com (Pierre Joye)

On Sun, Feb 2, 2014 at 11:12 AM, Yasuo Ohgaki <yohgaki@ohgaki.net> wrote:
> On Sun, Feb 2, 2014 at 4:35 PM, Martin Jansen <martin@divbyzero.net> wrote:
>
>> On 02.02.14 05:32, Yasuo Ohgaki wrote:
>> >  string safe_uniqid([ing $length=64])
>> >
>> > It generate ID using good RNG such as /dev/urandom, /dev/arandom for
>> > UNIXes, openssl RNG for Windows when they are available. It does not use
>> > hash function, but simply convert RNG binary data into text. The same
>> > algorithm that is used for session ID may be used. (Use
>> > hash_bits_per_character=5, since it only contains alphanumeric chars)
>> Since
>> > it does not use hash, it's fast.
>> >
>> > Any comments? Any good names?
>>
>> The documentation for uniqid() is pretty clear about the fact that it's
>> not cryptographically secure and recomends openssl_random_pseudo_bytes()
>> as a replacement. Shouldn't we just try to come up with sane default
>> values for its $length parameter instead of adding yet another new
>> function?
>>
>
> I added the warning to the doc recently.

As far as I remember there was always a note about the non secure
usage uniqid. That's not something new, or am I mistaken?

> I see codes that uses uniqid() as a source of safe unique id generation
> using
> hash functions which is not secure in fact.

Right, I see many insecure codes out there, even things like
unfiltered input usage. It does mean we can enable default filter per
default, f.e.


> We are better to provide easy to use safe unique ID generation function to
> prevent this kind of usage even if user could do in user land. Writing a
> portable one is not simple enough.


We have one, http://de2.php.net/manual/en/function.openssl-random-pseudo-bytes.php.
It depends on openssl, but it is safe for the cases defined in your
other thread about session. On windows it is even always crypto safe.


>> string safe_uniqid([ing $length=64])

Besides the question about the need to add another function, I would
not use the word "safe" in any function name :)

>> P.S. Is anyone working UUID? PostgreSQL is using OSSP's UUID lib, it's
>> good
>> > for PHP.
>> > http://www.postgresql.org/docs/9.2/interactive/uuid-ossp.html
>>
>> There's http://pecl.php.net/package/uuid.
>
>
> It uses ext2 UUID. Isn' it only available for linux, is it?
> It' a LGPL license also. It's not preferred license for core...

As long as it is not bundled, there is no big deal. And it should not
be lgpl v3, this license is a mess :)

Cheers,
-- 
Pierre

@pierrejoye | http://www.libgd.org