Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:72035
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.212.42 as permitted sender)
MIME-Version: 1.0
In-Reply-To: <CAGa2bXaE5f=nY7mOxcB4ZMjronY6j8bA1n+DcOOR+zXnLR_cng@mail.gmail.com>
References: <CAGa2bXbq1ttBz+hSk20-CkKWvDdHr5+8bBmc04Q22i7K2VSs+A@mail.gmail.com>
	<52EDF552.4010208@divbyzero.net>
	<CAGa2bXYJRUP58x_XSHgXBy0L0Yiprw=UP-suspWtVqkvYHKC2g@mail.gmail.com>
	<CAHMUw2FQ9vHtROk9NZf8Kwd7O2V3Z1uodu29NZOfDAp0B8M+yQ@mail.gmail.com>
	<CAGa2bXaE5f=nY7mOxcB4ZMjronY6j8bA1n+DcOOR+zXnLR_cng@mail.gmail.com>
Date: Mon, 3 Feb 2014 12:59:12 +0800
Message-ID: <CAHMUw2Eg513-+=BCDywYbZg8B6=Zz9hr=wk3+Fs-8OHfR-=+4A@mail.gmail.com>
To: Yasuo Ohgaki <yohgaki@ohgaki.net>
Cc: Martin Jansen <martin@divbyzero.net>, 
	"internals@lists.php.net" <internals@lists.php.net>
Content-Type: multipart/alternative; boundary=047d7b6da0287a02d304f1796268
Subject: Re: [PHP-DEV] Extending uniqid() or not?
From: tjerk.meesters@gmail.com (Tjerk Meesters)

--047d7b6da0287a02d304f1796268
Content-Type: text/plain; charset=ISO-8859-1

On Mon, Feb 3, 2014 at 9:13 AM, Yasuo Ohgaki <yohgaki@ohgaki.net> wrote:

> Hi Tjerk,
>
> On Mon, Feb 3, 2014 at 8:55 AM, Tjerk Meesters <tjerk.meesters@gmail.com>wrote:
>
>> I think it would be good enough to have only uuid v4:
>>
>> function uuidv4()
>> {
>>     $data = openssl_random_pseudo_bytes(16); // or whatever
>>
>>     $data[6] = chr(ord($data[6]) & 0x0f | 0x40); // set version to 0010
>>     $data[8] = chr(ord($data[8]) & 0x3f | 0x80); // set bits 6-7 to 10
>>
>>     return vsprintf('%s%s-%s-%s-%s-%s%s%s', str_split(bin2hex($data), 4));
>> }
>>
>> It's really just a representation of random data, whereby 6 bits are used
>> for the actual format.
>>
>
> I agree.
> UUID v4 simply generate random ID and it is good for many purposes.
>
> My concern is portability. OpenSSL(or Mcrypt) is provided as module.
> Users tends not to use module functions whenever possible. To address
> this issue, OpenSSL could be a module compiled by default.
>

You could simply choose between `php_win32_get_random_bytes()` (Windows) or
reading directly from `/dev/xrandom`. Ultimately you have to be prepared to
supplement the data (partially or fully) with calls to `php_rand()`.


> Security matters for all applications. Compiling OpenSSL by default would
> be nice to have.
>
> Any comments?
>
> --
> Yasuo Ohgaki
> yohgaki@ohgaki.net
>
>


-- 
--
Tjerk

--047d7b6da0287a02d304f1796268--