Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:72603
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.216.180 as permitted sender)
MIME-Version: 1.0
In-Reply-To: <CAEKnhAErZ_K3=vPvGEcDBMtT4f_rnawgAu4D=CCeedgp9OqaHw@mail.gmail.com>
References: <CAPhkiZz91t5i+MxP8-P5zLtr9+1h3NyJfy2FO0PjhVZbG4LqBA@mail.gmail.com>
	<CAEZPtU72hXjKJ4VMhNa1pYi09vNgC6KkOmgk5Ld3+XWt_092EQ@mail.gmail.com>
	<CAPhkiZynD5JF15PrWN1Bxv=UEdkPm+RrGOnpp3oAQiSjbBY3+Q@mail.gmail.com>
	<CAEZPtU7UnOg_Q1A-4+v7kfaW0-3cUFpO6Le91GDRki4y3xSnxg@mail.gmail.com>
	<CAEKnhAGZ0VY5H0nKvzCoK2Rx-ORkkbFE1WFEZr=VkzTWvXXGfQ@mail.gmail.com>
	<CAPhkiZxTFU-bxyX4QeAO7cnTdEua+M2BSn2dTQ48kxga+VOALw@mail.gmail.com>
	<CAEKnhAErZ_K3=vPvGEcDBMtT4f_rnawgAu4D=CCeedgp9OqaHw@mail.gmail.com>
Date: Fri, 14 Feb 2014 16:41:04 +0100
Message-ID: <CAEZPtU69JCsDNtHkHuVed8BMPNJfFADDNNZnEeaaZCxJ_NTpsw@mail.gmail.com>
To: Jakub Zelenka <bukka@php.net>
Cc: PHP internals <internals@lists.php.net>, Andrey Andreev <narf@devilix.net>
Content-Type: multipart/alternative; boundary=001a113471b6446bdb04f25fa280
Subject: Re: [PHP-DEV] unify entropy source for all php related functions
From: pierre.php@gmail.com (Pierre Joye)

--001a113471b6446bdb04f25fa280
Content-Type: text/plain; charset=UTF-8

On Feb 14, 2014 10:30 PM, "Jakub Zelenka" <bukka@php.net> wrote:

> The point is that OpenSSL considers /dev/urandom strong enough for
seeding CSPRNG.

The point here is about whether /Dev/urandom is cs or not. It is not. It
may be (on recent updated systems) enough to be used as seed but not to
actually generate cs random data.

Also it is important to keep mind that openssl does more than simply read
from urandom or random to generate data. That's outside the scope of what
is proposed here.

Cheers,
Pierre

--001a113471b6446bdb04f25fa280--