Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:82117
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.216.174 as permitted sender)
MIME-Version: 1.0
Sender: yohgaki@gmail.com
In-Reply-To: <D0FBCF22.5D217%fsb@thefsb.org>
References: <D0FBCF22.5D217%fsb@thefsb.org>
Date: Sun, 8 Feb 2015 14:47:59 +0900
Message-ID: <CAGa2bXavqvp5St5in4ckWamVO8GcpkBqH2KOXATLkaFrQa7t0w@mail.gmail.com>
To: Tom Worster <fsb@thefsb.org>, Pierre Joye <pierre.php@gmail.com>
Cc: php-internals <internals@lists.php.net>
Content-Type: multipart/alternative; boundary=001a113a2aa2a6cc2b050e8d346f
Subject: Re: [PHP-DEV] Security changes in PHP 7
From: yohgaki@ohgaki.net (Yasuo Ohgaki)

--001a113a2aa2a6cc2b050e8d346f
Content-Type: text/plain; charset=UTF-8

Hi Tom,

On Sun, Feb 8, 2015 at 4:24 AM, Tom Worster <fsb@thefsb.org> wrote:

> 1. Will there be a portable API for getting random bytes from the
> platform's CSPRNG?
>
> https://wiki.php.net/ideas/php6 lists as an addition: "Reliable,
> userfriendly RNG APIs: Provide a userfriendly and reliable RNG APIs,
> available by default, on all supported platforms and for all usages
> (from weak to crypto safe)."
>

Pierre,

What the status?



> 2. What's going to happen to mcrypt?
>
> I see the vote to excise it did not pass. Does this mean that (i.e.
> imply that) PHP's plan is to keep a security lib that hasn't been
> maintained for 8 years for the next 5+ years?
>

Removed.
Available as PECL module.
Probably.


>
>
> 3. Will the OpenSSL ext remain as it currently stands?
>
> There have been a few discussions about this but I'm not clear if any
> decisions have been made about changing it or providing a new API.
>

Not sure on this


>
>
> 4. What does openssl_random_pseudo_bytes() really do in PHP?
>
> Where does it get random bytes from in the various different platforms?
> Is it going to change in PHP 7?
>

It's depend on openssl. What openssl does is what it does.


>
>
> 5. Is the weird Linux /dev/random[1] still supported? If so, is used
> by default in any PHP API?
>

Session module use it.
/dev/urandom or /dev/arundom


>
>
> 6. I noticed some work on constant-time functions. Is this for security
> purposes, i.e. defeating remote timing attacks? Is there an RFC?
>
>
>
No, but there is patch.
Status?

Regards,


--
Yasuo Ohgaki
yohgaki@ohgaki.net

--001a113a2aa2a6cc2b050e8d346f--