Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:79578
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 74.125.82.46 as permitted sender)
MIME-Version: 1.0
In-Reply-To: <5489BA91.30503@cubiclesoft.com>
References: <CAPKwhwsOZiGPkvEtXYCBX3dJP3SJ=PTrwqRtQWVzX3SegK6jsg@mail.gmail.com>
	<5487E91D.6070602@fedoraproject.org>
	<648FEBB3-9D71-4AE3-BFDA-5ED268FC02A7@ajf.me>
	<alpine.DEB.2.11.1412111009330.4080@whisky.home.derickrethans.nl>
	<5489BA91.30503@cubiclesoft.com>
Date: Thu, 11 Dec 2014 19:44:53 +0000
Message-ID: <CAPwsocFjvsamW6AutLyqwzk1UbmQjYWJ86coWtuf5rKijhbZ9g@mail.gmail.com>
To: Thomas Hruska <thruska@cubiclesoft.com>
Cc: PHP Development <internals@lists.php.net>
Content-Type: text/plain; charset=UTF-8
Subject: Re: [PHP-DEV] libmcrypt: abandonware?
From: leight@gmail.com (Leigh)

On 11 December 2014 at 15:38, Thomas Hruska <thruska@cubiclesoft.com> wrote:
>
> To date, there still isn't a way to access CryptGenRandom() from userland
> without an extension.  Access to that Windows function depends on an
> extension to expose php_win32_get_random_bytes() to userland.
> mcrypt_create_iv() and openssl_random_pseudo_bytes() are the two userland
> functions that do that and mcrypt is compiled into the Windows builds by
> default.  There's nothing in core for getting entropy in userland on Windows
> despite the fact that two extensions use a function already in the core.
>
> If mcrypt is removed and no suitable replacement function for
> mcrypt_create_iv() is put in place on Windows, the user will be forced to
> load a library that may not even get used.  This is possible because
> openssl_random_pseudo_bytes() does not actually depend on OpenSSL under
> Windows as it calls the php_win32_get_random_bytes() function instead - but
> the 1MB OpenSSL library will get loaded anyway.
>
> php_win32_get_random_bytes() should be consistently accessible on Windows
> via an ext/standard userland function that gets random bytes of data.  Other
> than mcrypt_create_iv(), I don't care about the rest of mcrypt.
>

I actually think a generic random bytes function outside of any
cryptographic extensions would be a good idea. Even mcrypt seems like
overkill if all you want is random strings.