Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:72547
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.217.175 as permitted sender)
MIME-Version: 1.0
Sender: yohgaki@gmail.com
In-Reply-To: <CAEZPtU7NJYRrsMMnNZZZ2fi_XSvqG5J=85=kd9yO5c54zfDCSw@mail.gmail.com>
References: <CAEZPtU7NJYRrsMMnNZZZ2fi_XSvqG5J=85=kd9yO5c54zfDCSw@mail.gmail.com>
Date: Thu, 13 Feb 2014 16:21:07 +0900
Message-ID: <CAGa2bXb0cAPMKuEGLW8pnQ8xNQ=G0UWHaaGRrcjJ9PvuSoT2Ww@mail.gmail.com>
To: Pierre Joye <pierre.php@gmail.com>, julien pauli <jpauli@php.net>
Cc: PHP internals <internals@lists.php.net>
Content-Type: multipart/alternative; boundary=089e0160b618d2870e04f2448ad7
Subject: Re: [PHP-DEV] unify entropy source for all php related functions
From: yohgaki@ohgaki.net (Yasuo Ohgaki)

--089e0160b618d2870e04f2448ad7
Content-Type: text/plain; charset=UTF-8

Hi all,

On Fri, Feb 7, 2014 at 8:25 PM, Pierre Joye <pierre.php@gmail.com> wrote:

> There are a lot of additions and discussions about entropy source and
> (P)RNG lately.
>
> PHP already has a ini setting to define a strong entropy source for
> the session module, which defaults to urandom or arandom.
>
> I would like to create two settings to unify the entropy source
> accross php functions. That includes mcrypt, new password APIs,
> session, LCG, etc.
>
> Something along this line:
>
> random.entropy_strong_source (/dev/(u|a)random etc.)
> random.entropy_crypto_source (/dev/random etc.)
>
> I am not willing to propose new RNG functions or extensions for 5.6 as
> we have way too little time to actually discuss its design and APIs.
> However having these settings unified and documented would be a good
> step forward already.
>
> Thoughts?
>

I would like to have this.
This simplifies code uses /dev/*random.

I may write patch for this as well as
rand_strong_bytes()/rand_crypto_bytes().
Since it's too late for 5.6, I'll commit only to master.
Does anyone think this change needs RFC?

Or this is mandatory for good security, include it in 5.6?
What do you think, Julien?

Regards

--
Yasuo Ohgaki
yohgaki@ohgaki.net

--089e0160b618d2870e04f2448ad7--