Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:83702
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.217.170 as permitted sender)
MIME-Version: 1.0
In-Reply-To: <CAAyV7nF8YGzDVTccWUSowVzD0=p1eF7e3NLC=zRO0CXiD8nc=w@mail.gmail.com>
References: <CALYT1YrHA=E13eqzKnLSPSATdxRy_201yVDp-cdPurQeSkBhrQ@mail.gmail.com>
	<CAEZPtU6ZZ1MuoRvZooBgRmxQQ4p5jGFmUoVURwLfgVWhTqpkUg@mail.gmail.com>
	<CAPwsocH6HHVFYAycO-ZFnTKJzW1J8nuRS-x115ttY=wP0eukAg@mail.gmail.com>
	<CAEZPtU5EQO07tPSazwHbpqF38PdUMNyZhAQoiZ+ejvhnFDcKsg@mail.gmail.com>
	<CAAyV7nHE_Y-H-m5sgZTM=q-MKDXg0ycitTN+--0bPBQcSd8T2g@mail.gmail.com>
	<CALwr1G=BqkNrcxmG8DxRoHPo-US_eY=CrBVY7jeY_0Ekzao02g@mail.gmail.com>
	<CAAyV7nF8YGzDVTccWUSowVzD0=p1eF7e3NLC=zRO0CXiD8nc=w@mail.gmail.com>
Date: Tue, 24 Feb 2015 21:45:05 +0000
Message-ID: <CALwr1G=u_7+-RS2m55Ouir_Tjw86d34Lk3OjkOJYFDSs0_qU9g@mail.gmail.com>
To: Anthony Ferrara <ircmaxell@gmail.com>
Cc: Pierre Joye <pierre.php@gmail.com>, Leigh <leight@gmail.com>, 
	Sammy Kaye Powers <me@sammyk.me>, PHP internals <internals@lists.php.net>
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
Subject: Re: [PHP-DEV] [RFC] [DISCUSSION] Reliable user-land CSPRNG
From: padraic.brady@gmail.com (=?UTF-8?Q?P=C3=A1draic_Brady?=)

Hi

On 24 February 2015 at 21:33, Anthony Ferrara <ircmaxell@gmail.com> wrote:
> Padraic,
>
> On Tue, Feb 24, 2015 at 4:17 PM, P=C3=A1draic Brady <padraic.brady@gmail.=
com> wrote:
>> Hi
>>
>> On 24 February 2015 at 20:04, Anthony Ferrara <ircmaxell@gmail.com> wrot=
e:
>>> If random_bytes() is harder than uniqid(), it's a non-starter.
>>
>> Technically, it will be harder than uniqid() if producing strictly
>> random bytes (if output needs to be printable/readable).
>> That's not a "bad" thing obviously!
>
> Sure. But does that indicate the need for a "random_string()" function?

It would be more random than a stream of 0-9 integer characters, and
probably useful compared to base64'ing a byte stream. I'm afraid to go
survey how its done in the wild right now. Possibly?

Paddy

--
P=C3=A1draic Brady

http://blog.astrumfutura.com
http://www.survivethedeepend.com