Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:83705
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.192.49 as permitted sender)
MIME-Version: 1.0
Sender: yohgaki@gmail.com
In-Reply-To: <CAAyV7nF8YGzDVTccWUSowVzD0=p1eF7e3NLC=zRO0CXiD8nc=w@mail.gmail.com>
References: <CALYT1YrHA=E13eqzKnLSPSATdxRy_201yVDp-cdPurQeSkBhrQ@mail.gmail.com>
 <CAEZPtU6ZZ1MuoRvZooBgRmxQQ4p5jGFmUoVURwLfgVWhTqpkUg@mail.gmail.com>
 <CAPwsocH6HHVFYAycO-ZFnTKJzW1J8nuRS-x115ttY=wP0eukAg@mail.gmail.com>
 <CAEZPtU5EQO07tPSazwHbpqF38PdUMNyZhAQoiZ+ejvhnFDcKsg@mail.gmail.com>
 <CAAyV7nHE_Y-H-m5sgZTM=q-MKDXg0ycitTN+--0bPBQcSd8T2g@mail.gmail.com>
 <CALwr1G=BqkNrcxmG8DxRoHPo-US_eY=CrBVY7jeY_0Ekzao02g@mail.gmail.com> <CAAyV7nF8YGzDVTccWUSowVzD0=p1eF7e3NLC=zRO0CXiD8nc=w@mail.gmail.com>
Date: Wed, 25 Feb 2015 07:08:30 +0900
Message-ID: <CAGa2bXbtvkX9ZHgCEho=Mr1u_eHA-jfutReWOtKU957vJ=PxUQ@mail.gmail.com>
To: Anthony Ferrara <ircmaxell@gmail.com>
Cc: =?UTF-8?Q?P=C3=A1draic_Brady?= <padraic.brady@gmail.com>, 
	Pierre Joye <pierre.php@gmail.com>, Leigh <leight@gmail.com>, 
	Sammy Kaye Powers <me@sammyk.me>, PHP internals <internals@lists.php.net>
Content-Type: multipart/alternative; boundary=001a1135a3dcee7b1b050fdcc401
Subject: Re: [PHP-DEV] [RFC] [DISCUSSION] Reliable user-land CSPRNG
From: yohgaki@ohgaki.net (Yasuo Ohgaki)

--001a1135a3dcee7b1b050fdcc401
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

Hi all,

On Wed, Feb 25, 2015 at 6:33 AM, Anthony Ferrara <ircmaxell@gmail.com>
wrote:

> On Tue, Feb 24, 2015 at 4:17 PM, P=C3=A1draic Brady <padraic.brady@gmail.=
com>
> wrote:
> > Hi
> >
> > On 24 February 2015 at 20:04, Anthony Ferrara <ircmaxell@gmail.com>
> wrote:
> >> If random_bytes() is harder than uniqid(), it's a non-starter.
> >
> > Technically, it will be harder than uniqid() if producing strictly
> > random bytes (if output needs to be printable/readable).
> > That's not a "bad" thing obviously!
>
> Sure. But does that indicate the need for a "random_string()" function?
>
> I don't know...


Random bytes is better. People would use it for IV or like with the
size of IV. If we use string, users loose effective bits.

Regards,

--
Yasuo Ohgaki
yohgaki@ohgaki.net

--001a1135a3dcee7b1b050fdcc401--