Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:73002
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.216.172 as permitted sender)
MIME-Version: 1.0
In-Reply-To: <CAGa2bXYY9AFspz53D3AJyx+Ky5jsxY7cVKw7o07DR9ecgSCM2Q@mail.gmail.com>
References: <CAF+90c-zPTTdYp7pngUhE+8Tgt=c5KwaevRMepHo_GEE5k2Bug@mail.gmail.com>
	<CAEZPtU5Q153ku0dRrXvn7ysm-rF5O791pMxewdEnhSMg_+KGxg@mail.gmail.com>
	<CAGa2bXYY9AFspz53D3AJyx+Ky5jsxY7cVKw7o07DR9ecgSCM2Q@mail.gmail.com>
Date: Sat, 8 Mar 2014 08:01:02 +0100
Message-ID: <CAEZPtU4Ou-_2K-Ttnvgsqx_ub4t3JXdUqyjV7V5AsVZw-eXFuA@mail.gmail.com>
To: Yasuo Ohgaki <yohgaki@ohgaki.net>
Cc: Nikita Popov <nikita.ppv@gmail.com>, PHP internals <internals@lists.php.net>
Content-Type: text/plain; charset=UTF-8
Subject: Re: [PHP-DEV] Default mcrypt_create_iv() to /dev/urandom
From: pierre.php@gmail.com (Pierre Joye)

On Sat, Mar 8, 2014 at 1:18 AM, Yasuo Ohgaki <yohgaki@ohgaki.net> wrote:
> HI all,
>
> On Sat, Mar 8, 2014 at 2:18 AM, Pierre Joye <pierre.php@gmail.com> wrote:
>>
>> > One potential issue when using /dev/urandom is that on some systems
>> > (notably Linux, but not BSD) it will not block even if it can't gather
>> > enough initial entropy for seeding the CSPRNG and as such produce
>> > predicable outputs. This condition can only occur immediately after
>> > system
>> > startup and as per the /dev/random man page [1] this is mitigated by
>> > "all
>> > major Linux distributions [...] since 2000 at least" by saving a seed
>> file.
>> >
>> > As such I would suggest defaulting the mcrypt_create_iv() $source
>> parameter
>> > to MCRYPT_DEV_URANDOM. Objections?
>>
>> I have no objection as uramdom is good enough for 99.999% of php usage.

By the way, a very good read:

http://www.2uo.de/myths-about-urandom/

pretty much covers what we have been discussing here lately :)

and PHP fits in the "most of use cases" part of this post.

Cheers,
-- 
Pierre

@pierrejoye | http://www.libgd.org