Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:72386
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.217.174 as permitted sender)
MIME-Version: 1.0
In-Reply-To: <CAF+90c8T+=cUr6F79KA537Uf0nSwwWUf4BKUepHq0XQT4PwfnQ@mail.gmail.com>
References: <CAEZPtU7NJYRrsMMnNZZZ2fi_XSvqG5J=85=kd9yO5c54zfDCSw@mail.gmail.com>
	<CAF+90c8T+=cUr6F79KA537Uf0nSwwWUf4BKUepHq0XQT4PwfnQ@mail.gmail.com>
Date: Fri, 7 Feb 2014 15:43:20 +0000
Message-ID: <CALwr1GmbcQnq2vQ3T1W_GOJoVJDswERE7oasYwh15Lz7X=Y1bA@mail.gmail.com>
To: Nikita Popov <nikita.ppv@gmail.com>
Cc: Pierre Joye <pierre.php@gmail.com>, PHP internals <internals@lists.php.net>
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
Subject: Re: [PHP-DEV] unify entropy source for all php related functions
From: padraic.brady@gmail.com (=?UTF-8?Q?P=C3=A1draic_Brady?=)

Hi Nikita,

On 7 February 2014 12:58, Nikita Popov <nikita.ppv@gmail.com> wrote:
> On Fri, Feb 7, 2014 at 12:25 PM, Pierre Joye <pierre.php@gmail.com> wrote=
:
>
>> hi,
>>
>> There are a lot of additions and discussions about entropy source and
>> (P)RNG lately.
>>
>> PHP already has a ini setting to define a strong entropy source for
>> the session module, which defaults to urandom or arandom.
>>
>> I would like to create two settings to unify the entropy source
>> accross php functions. That includes mcrypt, new password APIs,
>> session, LCG, etc.
>>
>> Something along this line:
>>
>> random.entropy_strong_source (/dev/(u|a)random etc.)
>> random.entropy_crypto_source (/dev/random etc.)
>>
>> I am not willing to propose new RNG functions or extensions for 5.6 as
>> we have way too little time to actually discuss its design and APIs.
>> However having these settings unified and documented would be a good
>> step forward already.
>>
>
> To clarify what this proposal does (from otr discussion with Pierre):
>
>  * openssl_pseudo_random_bytes - not changed
>  * mcrypt_create_iv($n, MCRYPT_DEV_RANDOM) - uses crypto_source instead o=
f
> /dev/random
>  * mcrypt_create_iv($n, MCRYPT_DEV_URANDOM) - uses strong_source instead =
of
> /dev/urandom
>  * mcrypt_create_iv($n, MCRYPT_RAND) - not changed
>  * password_hash() - uses strong_source
>  * session ID - uses strong_source
>  * lcg_value, rand, mt_rand - not changed
>
> Hope everything is correct :)
>
> Nikita

Don't forget array_rand() and shuffle()... :P

But yes, that would be the expected outcome as I understand it.

Paddy

--
P=C3=A1draic Brady

http://blog.astrumfutura.com
http://www.survivethedeepend.com
Zend Framework Community Review Team
Zend Framework PHP-FIG Representative