Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:82150
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain damz.org designates 209.85.218.54 as permitted sender)
MIME-Version: 1.0
In-Reply-To: <CAH8MpnkZCnvdHE5yC_kgo8cisHULegjwndMZWdvTPOYrm9io3A@mail.gmail.com>
References: <CAH8MpnkZCnvdHE5yC_kgo8cisHULegjwndMZWdvTPOYrm9io3A@mail.gmail.com>
Date: Sun, 8 Feb 2015 18:04:18 +0100
Message-ID: <CALWK-fghgnXh8hgF3CpqOTvWU3UbcJrnZ=rZY1SNeU2SAuhnSg@mail.gmail.com>
To: Daniel Lowrey <rdlowrey@php.net>
Cc: "internals@lists.php.net" <internals@lists.php.net>, fsb@thefsb.dot.org
Content-Type: multipart/alternative; boundary=001a11c2e558f030b4050e96a4d6
Subject: Re: [PHP-DEV] Re: Security changes in PHP 7
From: damz@damz.org (Damien Tournoud)

--001a11c2e558f030b4050e96a4d6
Content-Type: text/plain; charset=UTF-8

On Sun, Feb 8, 2015 at 5:15 PM, Daniel Lowrey <rdlowrey@php.net> wrote:

> Currently PHP's openssl_random_pseudo_bytes() uses the latter function and
> allows users to pass a by-reference $crypto_strong out parameter to
> determine if the result is cryptographically strong. This is fine if you
> know all of the above and have read the manual for this function. However,
> it may be desirable to add a new openssl_rand_bytes() function that uses
> RAND_bytes() under the hood to make it less likely for someone to
> accidentally use insufficiently random output.


Hi Daniel,

Just to clarify: OpenSSL automatically seeds its random pool from
crypto-safe system-specific sources (/dev/[u]random on Linux): it is just
*impossible* on modern systems to end up in the case of not having enough
entropy.

Damien

--001a11c2e558f030b4050e96a4d6--