Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:72385
Return-Path: <nikita.ppv@gmail.com>
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Delivered-To: mailing list internals@lists.php.net
Received: (qmail 88498 invoked from network); 7 Feb 2014 12:58:36 -0000
Received: from unknown (HELO lists.php.net) (127.0.0.1)
  by localhost with SMTP; 7 Feb 2014 12:58:36 -0000
Authentication-Results: pb1.pair.com smtp.mail=nikita.ppv@gmail.com; spf=pass; sender-id=pass
Authentication-Results: pb1.pair.com header.from=nikita.ppv@gmail.com; sender-id=pass
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.219.52 as permitted sender)
X-PHP-List-Original-Sender: nikita.ppv@gmail.com
X-Host-Fingerprint: 209.85.219.52 mail-oa0-f52.google.com  
Received: from [209.85.219.52] ([209.85.219.52:65133] helo=mail-oa0-f52.google.com)
	by pb1.pair.com (ecelerity 2.1.1.9-wez r(12769M)) with ESMTP
	id 24/59-34013-B78D4F25 for <internals@lists.php.net>; Fri, 07 Feb 2014 07:58:35 -0500
Received: by mail-oa0-f52.google.com with SMTP id i4so4048217oah.25
        for <internals@lists.php.net>; Fri, 07 Feb 2014 04:58:31 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
        d=gmail.com; s=20120113;
        h=mime-version:in-reply-to:references:date:message-id:subject:from:to
         :cc:content-type;
        bh=2m7h2L2Add7/EEuhpjqrY9lBvmES0HcNi7D3mB22nEc=;
        b=ZcBW9zUfvH7iY2Gf3ON9bbnRUVB+pKoCKx/4T6dy+mbmo4JeJKU3+VICSWJ/HR4GUl
         Po6cTi/jT3yEA4cuiIXZNaHhAzOdOV8ZhfV33arAdMIBct8NUXqE0RatioMl6YLzVWE0
         uk9IYoSyecaTGpDE6XChcA6vP3UlA1bKSsFX/Bd6GqdZr/CY+S2eGMelbEF3goEYEOph
         6fWq7ZnAcSa/SO6mXOGBZ65iGJE74niIIipw0NPz5QE/U6tZ4TGAF7awPU5VrJW+7V9o
         1joSfuAl/ZysBW09A0qTmc+P4QPnnIwvROZaInvlnBHsEgdn4+bGD4Hgfm1Zj5JB6J0L
         fw0g==
MIME-Version: 1.0
X-Received: by 10.182.219.197 with SMTP id pq5mr1666322obc.64.1391777911470;
 Fri, 07 Feb 2014 04:58:31 -0800 (PST)
Received: by 10.182.54.112 with HTTP; Fri, 7 Feb 2014 04:58:31 -0800 (PST)
In-Reply-To: <CAEZPtU7NJYRrsMMnNZZZ2fi_XSvqG5J=85=kd9yO5c54zfDCSw@mail.gmail.com>
References: <CAEZPtU7NJYRrsMMnNZZZ2fi_XSvqG5J=85=kd9yO5c54zfDCSw@mail.gmail.com>
Date: Fri, 7 Feb 2014 13:58:31 +0100
Message-ID: <CAF+90c8T+=cUr6F79KA537Uf0nSwwWUf4BKUepHq0XQT4PwfnQ@mail.gmail.com>
To: Pierre Joye <pierre.php@gmail.com>
Cc: PHP internals <internals@lists.php.net>
Content-Type: multipart/alternative; boundary=089e0149c5f605029f04f1d08c89
Subject: Re: [PHP-DEV] unify entropy source for all php related functions
From: nikita.ppv@gmail.com (Nikita Popov)

--089e0149c5f605029f04f1d08c89
Content-Type: text/plain; charset=ISO-8859-1

On Fri, Feb 7, 2014 at 12:25 PM, Pierre Joye <pierre.php@gmail.com> wrote:

> hi,
>
> There are a lot of additions and discussions about entropy source and
> (P)RNG lately.
>
> PHP already has a ini setting to define a strong entropy source for
> the session module, which defaults to urandom or arandom.
>
> I would like to create two settings to unify the entropy source
> accross php functions. That includes mcrypt, new password APIs,
> session, LCG, etc.
>
> Something along this line:
>
> random.entropy_strong_source (/dev/(u|a)random etc.)
> random.entropy_crypto_source (/dev/random etc.)
>
> I am not willing to propose new RNG functions or extensions for 5.6 as
> we have way too little time to actually discuss its design and APIs.
> However having these settings unified and documented would be a good
> step forward already.
>

To clarify what this proposal does (from otr discussion with Pierre):

 * openssl_pseudo_random_bytes - not changed
 * mcrypt_create_iv($n, MCRYPT_DEV_RANDOM) - uses crypto_source instead of
/dev/random
 * mcrypt_create_iv($n, MCRYPT_DEV_URANDOM) - uses strong_source instead of
/dev/urandom
 * mcrypt_create_iv($n, MCRYPT_RAND) - not changed
 * password_hash() - uses strong_source
 * session ID - uses strong_source
 * lcg_value, rand, mt_rand - not changed

Hope everything is correct :)

Nikita

--089e0149c5f605029f04f1d08c89--