Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:72050
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.220.176 as permitted sender)
MIME-Version: 1.0
In-Reply-To: <CAEZPtU44pbx+4juoMdN1MjP_Ng3KnnJ_oLM9Ke6MNbXTTxHktA@mail.gmail.com>
References: <CAGa2bXbq1ttBz+hSk20-CkKWvDdHr5+8bBmc04Q22i7K2VSs+A@mail.gmail.com>
	<52EDF552.4010208@divbyzero.net>
	<CAGa2bXYJRUP58x_XSHgXBy0L0Yiprw=UP-suspWtVqkvYHKC2g@mail.gmail.com>
	<CAHMUw2FQ9vHtROk9NZf8Kwd7O2V3Z1uodu29NZOfDAp0B8M+yQ@mail.gmail.com>
	<CAGa2bXaE5f=nY7mOxcB4ZMjronY6j8bA1n+DcOOR+zXnLR_cng@mail.gmail.com>
	<CAHMUw2Eg513-+=BCDywYbZg8B6=Zz9hr=wk3+Fs-8OHfR-=+4A@mail.gmail.com>
	<CAEZPtU44pbx+4juoMdN1MjP_Ng3KnnJ_oLM9Ke6MNbXTTxHktA@mail.gmail.com>
Date: Mon, 3 Feb 2014 15:45:32 +0800
Message-ID: <CAHMUw2FHE68ESOGuk8sAngmowCYwnN+q_Zux_kCu-pLFN-DiLA@mail.gmail.com>
To: Pierre Joye <pierre.php@gmail.com>
Cc: Yasuo Ohgaki <yohgaki@ohgaki.net>, Martin Jansen <martin@divbyzero.net>, 
	"internals@lists.php.net" <internals@lists.php.net>
Content-Type: multipart/alternative; boundary=001a1133a1c051812e04f17bb54d
Subject: Re: [PHP-DEV] Extending uniqid() or not?
From: tjerk.meesters@gmail.com (Tjerk Meesters)

--001a1133a1c051812e04f17bb54d
Content-Type: text/plain; charset=ISO-8859-1

On Mon, Feb 3, 2014 at 2:25 PM, Pierre Joye <pierre.php@gmail.com> wrote:

> On Mon, Feb 3, 2014 at 5:59 AM, Tjerk Meesters <tjerk.meesters@gmail.com>
> wrote:
> > On Mon, Feb 3, 2014 at 9:13 AM, Yasuo Ohgaki <yohgaki@ohgaki.net> wrote:
> >
> >> Hi Tjerk,
> >>
> >> On Mon, Feb 3, 2014 at 8:55 AM, Tjerk Meesters <
> tjerk.meesters@gmail.com>wrote:
> >>
> >>> I think it would be good enough to have only uuid v4:
> >>>
> >>> function uuidv4()
> >>> {
> >>>     $data = openssl_random_pseudo_bytes(16); // or whatever
> >>>
> >>>     $data[6] = chr(ord($data[6]) & 0x0f | 0x40); // set version to 0010
> >>>     $data[8] = chr(ord($data[8]) & 0x3f | 0x80); // set bits 6-7 to 10
> >>>
> >>>     return vsprintf('%s%s-%s-%s-%s-%s%s%s', str_split(bin2hex($data),
> 4));
> >>> }
> >>>
> >>> It's really just a representation of random data, whereby 6 bits are
> used
> >>> for the actual format.
> >>>
> >>
> >> I agree.
> >> UUID v4 simply generate random ID and it is good for many purposes.
> >>
> >> My concern is portability. OpenSSL(or Mcrypt) is provided as module.
> >> Users tends not to use module functions whenever possible. To address
> >> this issue, OpenSSL could be a module compiled by default.
> >>
> >
> > You could simply choose between `php_win32_get_random_bytes()` (Windows)
> or
> > reading directly from `/dev/xrandom`. Ultimately you have to be prepared
> to
> > supplement the data (partially or fully) with calls to `php_rand()`.
>
> I cannot agree more, except for the php_rand part, we should avoid it.
> Both are more than enough for this purpose. As I wrote earlier, it is
> not necessary to have crypto safe RNGs for uuid generations,
>

The RFC [1] states v4 is used with truly-random or pseudo-random number
generators; it would be up to us to decide whether LCG is pseudo-random
enough :)

The generated values should be hard to guess, which typically means LCG
would not be suitable. The function (if implemented) could issue a warning
or notice if a preferred RNG could not be used, even though
`password_hash()` doesn't do this in the same scenario.

[1] http://tools.ietf.org/html/rfc4122#section-4.4

--001a1133a1c051812e04f17bb54d--