Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:81215
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.212.182 as permitted sender)
MIME-Version: 1.0
In-Reply-To: <CAGa2bXY3uaxkmuvYfOaM_Lnb=bHoqfXNFXOJqJJyNARAHv2G-g@mail.gmail.com>
References: <CAGa2bXbDV7wPwgvkGX5uhOS7B84YLUZ7Y--xZjd_pEQZroPKSg@mail.gmail.com>
	<CAGa2bXY3uaxkmuvYfOaM_Lnb=bHoqfXNFXOJqJJyNARAHv2G-g@mail.gmail.com>
Date: Tue, 27 Jan 2015 10:44:47 +0100
Message-ID: <CAH-PCH5oFVU1Ns4Sj6djmMesGEKM6oNjjyzOWDfkuhUeOQMMUw@mail.gmail.com>
To: Yasuo Ohgaki <yohgaki@ohgaki.net>
Cc: "internals@lists.php.net" <internals@lists.php.net>
Content-Type: multipart/alternative; boundary=089e010d849efeaf16050d9f1a82
Subject: Re: [PHP-DEV] Re: Discussion for RFC: Set appropriate/better defaults.
From: tyra3l@gmail.com (Ferenc Kovacs)

--089e010d849efeaf16050d9f1a82
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

On Tue, Jan 27, 2015 at 3:35 AM, Yasuo Ohgaki <yohgaki@ohgaki.net> wrote:

> Hi all,
>
> On Tue, Jan 27, 2015 at 11:06 AM, Yasuo Ohgaki <yohgaki@ohgaki.net> wrote=
:
>
> >  - session.hash_function=3D1 : Use SHA1 rather than MD5
>
>
> I realized that we should remove hashing for better performance.
>
> Since session ID is generated from crypt secure RNG (/dev/urandom by
> default),
> simply converting the data into text is enough. Hashing is _slow_.
>
> Any comments?
>

on the contrary, both sha1 and md5 is super fast, so I don't think that is
a good argument.
and if you remove the hashing there will be no known length for the session
id, and sooner or later people will screw themselves when bumping into some
limit or getting their session id truncated (be that a cookie max length or
a db field).

--=20
Ferenc Kov=C3=A1cs
@Tyr43l - http://tyrael.hu

--089e010d849efeaf16050d9f1a82--