Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:72047
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.215.49 as permitted sender)
MIME-Version: 1.0
Sender: yohgaki@gmail.com
In-Reply-To: <CAEZPtU44pbx+4juoMdN1MjP_Ng3KnnJ_oLM9Ke6MNbXTTxHktA@mail.gmail.com>
References: <CAGa2bXbq1ttBz+hSk20-CkKWvDdHr5+8bBmc04Q22i7K2VSs+A@mail.gmail.com>
 <52EDF552.4010208@divbyzero.net> <CAGa2bXYJRUP58x_XSHgXBy0L0Yiprw=UP-suspWtVqkvYHKC2g@mail.gmail.com>
 <CAHMUw2FQ9vHtROk9NZf8Kwd7O2V3Z1uodu29NZOfDAp0B8M+yQ@mail.gmail.com>
 <CAGa2bXaE5f=nY7mOxcB4ZMjronY6j8bA1n+DcOOR+zXnLR_cng@mail.gmail.com>
 <CAHMUw2Eg513-+=BCDywYbZg8B6=Zz9hr=wk3+Fs-8OHfR-=+4A@mail.gmail.com> <CAEZPtU44pbx+4juoMdN1MjP_Ng3KnnJ_oLM9Ke6MNbXTTxHktA@mail.gmail.com>
Date: Mon, 3 Feb 2014 16:20:27 +0900
Message-ID: <CAGa2bXZ6_fb=HA-Q18YpOqeQNwUZyjo+qW3T8knLs1zs29PuEw@mail.gmail.com>
To: Pierre Joye <pierre.php@gmail.com>
Cc: Tjerk Meesters <tjerk.meesters@gmail.com>, Martin Jansen <martin@divbyzero.net>, 
	"internals@lists.php.net" <internals@lists.php.net>
Content-Type: multipart/alternative; boundary=089e011832b201b5ab04f17b5e75
Subject: Re: [PHP-DEV] Extending uniqid() or not?
From: yohgaki@ohgaki.net (Yasuo Ohgaki)

--089e011832b201b5ab04f17b5e75
Content-Type: text/plain; charset=UTF-8

Hi all,

On Mon, Feb 3, 2014 at 3:25 PM, Pierre Joye <pierre.php@gmail.com> wrote:

> On Mon, Feb 3, 2014 at 5:59 AM, Tjerk Meesters <tjerk.meesters@gmail.com>
> wrote:
> > On Mon, Feb 3, 2014 at 9:13 AM, Yasuo Ohgaki <yohgaki@ohgaki.net> wrote:
> >
> >> Hi Tjerk,
> >>
> >> On Mon, Feb 3, 2014 at 8:55 AM, Tjerk Meesters <
> tjerk.meesters@gmail.com>wrote:
> >>
> >>> I think it would be good enough to have only uuid v4:
> >>>
> >>> function uuidv4()
> >>> {
> >>>     $data = openssl_random_pseudo_bytes(16); // or whatever
> >>>
> >>>     $data[6] = chr(ord($data[6]) & 0x0f | 0x40); // set version to 0010
> >>>     $data[8] = chr(ord($data[8]) & 0x3f | 0x80); // set bits 6-7 to 10
> >>>
> >>>     return vsprintf('%s%s-%s-%s-%s-%s%s%s', str_split(bin2hex($data),
> 4));
> >>> }
> >>>
> >>> It's really just a representation of random data, whereby 6 bits are
> used
> >>> for the actual format.
> >>>
> >>
> >> I agree.
> >> UUID v4 simply generate random ID and it is good for many purposes.
> >>
> >> My concern is portability. OpenSSL(or Mcrypt) is provided as module.
> >> Users tends not to use module functions whenever possible. To address
> >> this issue, OpenSSL could be a module compiled by default.
> >>
> >
> > You could simply choose between `php_win32_get_random_bytes()` (Windows)
> or
> > reading directly from `/dev/xrandom`. Ultimately you have to be prepared
> to
> > supplement the data (partially or fully) with calls to `php_rand()`.
>
> I cannot agree more, except for the php_rand part, we should avoid it.
> Both are more than enough for this purpose. As I wrote earlier, it is
> not necessary to have crypto safe RNGs for uuid generations,
> definitively not. It would be good not to suddenly overreact for
> something that should be better documented :)


I think use of RAND is bad idea for creating IVs.
I added E_NOTICE for it.

https://github.com/php/php-src/pull/579/files

E_WARNING might be better.

Regards,

--
Yasuo Ohgaki
yohgaki@ohgaki.net

--089e011832b201b5ab04f17b5e75--