Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:72375
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.128.182 as permitted sender)
MIME-Version: 1.0
In-Reply-To: <CAGa2bXbE1C9jk+tbA=aOurYtqEq18TkznVss166u-dqdSjVrbw@mail.gmail.com>
References: <52F485C1.4010208@cubiclesoft.com>
	<CAGa2bXbE1C9jk+tbA=aOurYtqEq18TkznVss166u-dqdSjVrbw@mail.gmail.com>
Date: Fri, 7 Feb 2014 19:31:08 +0800
Message-ID: <CAHMUw2ESWN5kavAOtKY4Nt=3xQfig4bC8o4KdEU2WhowossLyw@mail.gmail.com>
To: Yasuo Ohgaki <yohgaki@ohgaki.net>
Cc: Thomas Hruska <thruska@cubiclesoft.com>, PHP Development <internals@lists.php.net>
Content-Type: multipart/alternative; boundary=089e013a12f087f2f404f1cf531d
Subject: Re: [PHP-DEV] Make mcrypt_create_iv() an alias and move the code into /ext/standard
From: tjerk.meesters@gmail.com (Tjerk Meesters)

--089e013a12f087f2f404f1cf531d
Content-Type: text/plain; charset=ISO-8859-1

On Fri, Feb 7, 2014 at 6:30 PM, Yasuo Ohgaki <yohgaki@ohgaki.net> wrote:

> Hi Thomas,
>
> On Fri, Feb 7, 2014 at 4:05 PM, Thomas Hruska <thruska@cubiclesoft.com
> >wrote:
>
> > Moving the guts of this non-dependent function into the core would allow
> > mcrypt_create_iv() to just become an alias.  The new userland function
> > could be located in /ext/standard/rand.c and have an uncreative name like
> > rand_bytes().
>
>
> There is new great PECL package.
> http://pecl.php.net/package/crypto
> I would like to see it as default for crypt related feature.
>
> Anyway, we need default rundom_bytes() function in ext/standard. This is
> mandatory for secure apps, but we have no default function. This should be
> resolved.
>
> Anyway, mcrypt_create_iv() is not optimum, yet. Here is possible
> improvement.
>
> https://github.com/yohgaki/php-src/compare/PHP-5.6-mcrypt_create_iv
>
> It still requires random source and it does not support windows well,
> though.
> I'm about to adding new function which solves all of them like session
> module.
>

Speaking of which, it would be nice if session id generation depended on
this shiny new API as well ... basically we solve two problems:

1. An easy way to get a bunch of random bytes
2. Centralize random number generation internally, i.e. session ids and
password salts are generated with it.

I'm not sure whether this should extend to providing an easy way to
generate crypto safe random numbers, but that would obviously be nice if
feasible.


> Regards,
>
> --
> Yasuo Ohgaki
> yohgaki@ohgaki.net
>



-- 
--
Tjerk

--089e013a12f087f2f404f1cf531d--