Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:72083
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.160.174 as permitted sender)
MIME-Version: 1.0
In-Reply-To: <CAGa2bXbq1ttBz+hSk20-CkKWvDdHr5+8bBmc04Q22i7K2VSs+A@mail.gmail.com>
References: <CAGa2bXbq1ttBz+hSk20-CkKWvDdHr5+8bBmc04Q22i7K2VSs+A@mail.gmail.com>
Date: Mon, 3 Feb 2014 11:48:52 +0000
Message-ID: <CALwr1GkHJHy2obtO3QrE_-CBYNqUVrjOPbWe0_xTLX9HbXapwQ@mail.gmail.com>
To: Yasuo Ohgaki <yohgaki@ohgaki.net>
Cc: "internals@lists.php.net" <internals@lists.php.net>
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
Subject: Re: [PHP-DEV] Extending uniqid() or not?
From: padraic.brady@gmail.com (=?UTF-8?Q?P=C3=A1draic_Brady?=)

Hi Yasuo,

On 2 February 2014 04:32, Yasuo Ohgaki <yohgaki@ohgaki.net> wrote:
> Hi all,
>
> uniqid() is producing unique ID for the system which is good for email's
> message ID etc. Many users are using uniqid() as secure unique ID which i=
s
> very bad thing to do for security.
>
> It may be extend to produce safe unique ID
>
>  string uniqid(TRUE) - Returns random ID string which is safe to use
> security purposes.
>
> My concern is that uniqid() return both safe and unsafe ID which may not =
be
> good. We may better to have new function, perhaps

Mildly off-topic, the function has another outcome aside from any pure
role as a secure ID generator in that it leaks very specific timing
information which could be useful to unfriendly people:

$id =3D uniqid();
$time =3D str_split($id, 8);
$sec =3D hexdec('0x' . $time[0]);
$usec =3D hexdec('0x' . $time[1]);
echo 'Seconds: ', $sec, PHP_EOL, 'Microseconds: ', $usec, PHP_EOL;

The format is preserved even with additional parameters to the function.

Using the function at all is problematic.

--
P=C3=A1draic Brady

http://blog.astrumfutura.com
http://www.survivethedeepend.com
Zend Framework Community Review Team
Zend Framework PHP-FIG Representative