Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:83703
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.217.176 as permitted sender)
MIME-Version: 1.0
In-Reply-To: <CALwr1G=u_7+-RS2m55Ouir_Tjw86d34Lk3OjkOJYFDSs0_qU9g@mail.gmail.com>
References: <CALYT1YrHA=E13eqzKnLSPSATdxRy_201yVDp-cdPurQeSkBhrQ@mail.gmail.com>
	<CAEZPtU6ZZ1MuoRvZooBgRmxQQ4p5jGFmUoVURwLfgVWhTqpkUg@mail.gmail.com>
	<CAPwsocH6HHVFYAycO-ZFnTKJzW1J8nuRS-x115ttY=wP0eukAg@mail.gmail.com>
	<CAEZPtU5EQO07tPSazwHbpqF38PdUMNyZhAQoiZ+ejvhnFDcKsg@mail.gmail.com>
	<CAAyV7nHE_Y-H-m5sgZTM=q-MKDXg0ycitTN+--0bPBQcSd8T2g@mail.gmail.com>
	<CALwr1G=BqkNrcxmG8DxRoHPo-US_eY=CrBVY7jeY_0Ekzao02g@mail.gmail.com>
	<CAAyV7nF8YGzDVTccWUSowVzD0=p1eF7e3NLC=zRO0CXiD8nc=w@mail.gmail.com>
	<CALwr1G=u_7+-RS2m55Ouir_Tjw86d34Lk3OjkOJYFDSs0_qU9g@mail.gmail.com>
Date: Tue, 24 Feb 2015 16:50:48 -0500
Message-ID: <CAAyV7nEFoNYTc0XnbLh7NYFzg0AnFO6zKLtgw-x04U48Z==kbQ@mail.gmail.com>
To: =?UTF-8?Q?P=C3=A1draic_Brady?= <padraic.brady@gmail.com>
Cc: Pierre Joye <pierre.php@gmail.com>, Leigh <leight@gmail.com>, 
	Sammy Kaye Powers <me@sammyk.me>, PHP internals <internals@lists.php.net>
Content-Type: text/plain; charset=UTF-8
Subject: Re: [PHP-DEV] [RFC] [DISCUSSION] Reliable user-land CSPRNG
From: ircmaxell@gmail.com (Anthony Ferrara)

Padraic,

>>> Technically, it will be harder than uniqid() if producing strictly
>>> random bytes (if output needs to be printable/readable).
>>> That's not a "bad" thing obviously!
>>
>> Sure. But does that indicate the need for a "random_string()" function?
>
> It would be more random than a stream of 0-9 integer characters, and
> probably useful compared to base64'ing a byte stream. I'm afraid to go
> survey how its done in the wild right now. Possibly?

I've done it two ways:

Bitmasks:
https://github.com/ircmaxell/RandomLib/blob/master/lib/RandomLib/Generator.php#L228

String of characters:
https://github.com/ircmaxell/random_compat/blob/master/lib/random.php#L147

I think the latter is the easiest, especially if we define constants
with "normal" char lists: "ALPHA", "ALPHA_NUMERIC", "BASE64", etc and
default to "ALPHA_NUMERIC"...

Tho I am sure there are other ways out there.

Anthony