Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:72377
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.220.182 as permitted sender)
MIME-Version: 1.0
In-Reply-To: <CAEZPtU7NJYRrsMMnNZZZ2fi_XSvqG5J=85=kd9yO5c54zfDCSw@mail.gmail.com>
References: <CAEZPtU7NJYRrsMMnNZZZ2fi_XSvqG5J=85=kd9yO5c54zfDCSw@mail.gmail.com>
Date: Fri, 7 Feb 2014 19:42:46 +0800
Message-ID: <CAHMUw2GOTY82_yxKLdqza8KrbHOSf11GF4Js_xz8jcjtejEmqA@mail.gmail.com>
To: Pierre Joye <pierre.php@gmail.com>
Cc: PHP internals <internals@lists.php.net>
Content-Type: multipart/alternative; boundary=047d7bea3a4e1aa4f904f1cf7da4
Subject: Re: [PHP-DEV] unify entropy source for all php related functions
From: tjerk.meesters@gmail.com (Tjerk Meesters)

--047d7bea3a4e1aa4f904f1cf7da4
Content-Type: text/plain; charset=ISO-8859-1

On Fri, Feb 7, 2014 at 7:25 PM, Pierre Joye <pierre.php@gmail.com> wrote:

> hi,
>
> There are a lot of additions and discussions about entropy source and
> (P)RNG lately.
>
> PHP already has a ini setting to define a strong entropy source for
> the session module, which defaults to urandom or arandom.
>
> I would like to create two settings to unify the entropy source
> accross php functions. That includes mcrypt, new password APIs,
> session, LCG, etc.
>
> Something along this line:
>
> random.entropy_strong_source (/dev/(u|a)random etc.)
> random.entropy_crypto_source (/dev/random etc.)
>
> I am not willing to propose new RNG functions or extensions for 5.6 as
> we have way too little time to actually discuss its design and APIs.
> However having these settings unified and documented would be a good
> step forward already.
>

Here's a wild idea; assuming for a second that `rand()` is actually fed by
a proper entropy source, are there BC implications if we did that? :)

Alternatively, we would be looking at dedicated `random_` functions that
provide a similar functionality and end up with an API such as:

int random_integer($min, $max)
string random_string($length, $crypto_safe)

etc...


>
> Thoughts?
>
> Cheers,
> --
> Pierre
>
> @pierrejoye | http://www.libgd.org
>
> --
> PHP Internals - PHP Runtime Development Mailing List
> To unsubscribe, visit: http://www.php.net/unsub.php
>
>


-- 
--
Tjerk

--047d7bea3a4e1aa4f904f1cf7da4--