Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:72379
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.215.51 as permitted sender)
MIME-Version: 1.0
In-Reply-To: <CAEZPtU7NJYRrsMMnNZZZ2fi_XSvqG5J=85=kd9yO5c54zfDCSw@mail.gmail.com>
References: <CAEZPtU7NJYRrsMMnNZZZ2fi_XSvqG5J=85=kd9yO5c54zfDCSw@mail.gmail.com>
Date: Fri, 7 Feb 2014 11:53:00 +0000
Message-ID: <CALwr1Gm+d+y_qyZ45RTBk+BuOSvTqixXKAh3UxKiG_pHhonVDw@mail.gmail.com>
To: Pierre Joye <pierre.php@gmail.com>
Cc: PHP internals <internals@lists.php.net>
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
Subject: Re: [PHP-DEV] unify entropy source for all php related functions
From: padraic.brady@gmail.com (=?UTF-8?Q?P=C3=A1draic_Brady?=)

Hi Pierre,

On 7 February 2014 11:25, Pierre Joye <pierre.php@gmail.com> wrote:
> hi,
>
> There are a lot of additions and discussions about entropy source and
> (P)RNG lately.
>
> PHP already has a ini setting to define a strong entropy source for
> the session module, which defaults to urandom or arandom.
>
> I would like to create two settings to unify the entropy source
> accross php functions. That includes mcrypt, new password APIs,
> session, LCG, etc.
>
> Something along this line:
>
> random.entropy_strong_source (/dev/(u|a)random etc.)
> random.entropy_crypto_source (/dev/random etc.)

In principle, that makes a lot of sense. It beats wondering what each
different function is using under the covers and may even simplify
userland code a bit (and reduce some file checking if it can be relied
upon).

> I am not willing to propose new RNG functions or extensions for 5.6 as
> we have way too little time to actually discuss its design and APIs.
> However having these settings unified and documented would be a good
> step forward already.

I think the end goal should be unification with some generalised API.
At the moment we have mt_rand(), lcg_value(),
openssl_random_pseudo_bytes(), mcrypt_create_iv() and then the file
read approaches. They all have uses, but they sit in different places
and extensions and it=E2=80=99s not always clear what each is best at. I ag=
ree
that this would take a lot of time to work through.

--
P=C3=A1draic Brady

http://blog.astrumfutura.com
http://www.survivethedeepend.com
Zend Framework Community Review Team
Zend Framework PHP-FIG Representative