Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:72040
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.216.171 as permitted sender)
MIME-Version: 1.0
In-Reply-To: <CAHMUw2Eg513-+=BCDywYbZg8B6=Zz9hr=wk3+Fs-8OHfR-=+4A@mail.gmail.com>
References: <CAGa2bXbq1ttBz+hSk20-CkKWvDdHr5+8bBmc04Q22i7K2VSs+A@mail.gmail.com>
	<52EDF552.4010208@divbyzero.net>
	<CAGa2bXYJRUP58x_XSHgXBy0L0Yiprw=UP-suspWtVqkvYHKC2g@mail.gmail.com>
	<CAHMUw2FQ9vHtROk9NZf8Kwd7O2V3Z1uodu29NZOfDAp0B8M+yQ@mail.gmail.com>
	<CAGa2bXaE5f=nY7mOxcB4ZMjronY6j8bA1n+DcOOR+zXnLR_cng@mail.gmail.com>
	<CAHMUw2Eg513-+=BCDywYbZg8B6=Zz9hr=wk3+Fs-8OHfR-=+4A@mail.gmail.com>
Date: Mon, 3 Feb 2014 07:25:20 +0100
Message-ID: <CAEZPtU44pbx+4juoMdN1MjP_Ng3KnnJ_oLM9Ke6MNbXTTxHktA@mail.gmail.com>
To: Tjerk Meesters <tjerk.meesters@gmail.com>
Cc: Yasuo Ohgaki <yohgaki@ohgaki.net>, Martin Jansen <martin@divbyzero.net>, 
	"internals@lists.php.net" <internals@lists.php.net>
Content-Type: text/plain; charset=UTF-8
Subject: Re: [PHP-DEV] Extending uniqid() or not?
From: pierre.php@gmail.com (Pierre Joye)

On Mon, Feb 3, 2014 at 5:59 AM, Tjerk Meesters <tjerk.meesters@gmail.com> wrote:
> On Mon, Feb 3, 2014 at 9:13 AM, Yasuo Ohgaki <yohgaki@ohgaki.net> wrote:
>
>> Hi Tjerk,
>>
>> On Mon, Feb 3, 2014 at 8:55 AM, Tjerk Meesters <tjerk.meesters@gmail.com>wrote:
>>
>>> I think it would be good enough to have only uuid v4:
>>>
>>> function uuidv4()
>>> {
>>>     $data = openssl_random_pseudo_bytes(16); // or whatever
>>>
>>>     $data[6] = chr(ord($data[6]) & 0x0f | 0x40); // set version to 0010
>>>     $data[8] = chr(ord($data[8]) & 0x3f | 0x80); // set bits 6-7 to 10
>>>
>>>     return vsprintf('%s%s-%s-%s-%s-%s%s%s', str_split(bin2hex($data), 4));
>>> }
>>>
>>> It's really just a representation of random data, whereby 6 bits are used
>>> for the actual format.
>>>
>>
>> I agree.
>> UUID v4 simply generate random ID and it is good for many purposes.
>>
>> My concern is portability. OpenSSL(or Mcrypt) is provided as module.
>> Users tends not to use module functions whenever possible. To address
>> this issue, OpenSSL could be a module compiled by default.
>>
>
> You could simply choose between `php_win32_get_random_bytes()` (Windows) or
> reading directly from `/dev/xrandom`. Ultimately you have to be prepared to
> supplement the data (partially or fully) with calls to `php_rand()`.

I cannot agree more, except for the php_rand part, we should avoid it.
Both are more than enough for this purpose. As I wrote earlier, it is
not necessary to have crypto safe RNGs for uuid generations,
definitively not. It would be good not to suddenly overreact for
something that should be better documented :)

Cheers,
-- 
Pierre

@pierrejoye | http://www.libgd.org