Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:83898
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.216.47 as permitted sender)
MIME-Version: 1.0
In-Reply-To: <54EEDDDD.3020607@gmail.com>
References: <D1138D6D.5DCE0%fsb@thefsb.org>
	<CAPwsocFtOnB_9uEJUXF-JLhrx0umeW7pKM_mYKRG2eBOM6oYwQ@mail.gmail.com>
	<CAEZPtU4Z9pSKydr-gH43nvDwtGfLTQv_RArqVk2SQg2qLoYZ2A@mail.gmail.com>
	<CAEZPtU7V_DKvrSAJZZA=OaktXpuPsGCuAzggobvSS63VUxbDTA@mail.gmail.com>
	<CALYT1Yp_szH_M=4ufwVXAng9iuva8rahqazjjZX+Br717k0urg@mail.gmail.com>
	<54EEDDDD.3020607@gmail.com>
Date: Thu, 26 Feb 2015 07:45:11 -0800
Message-ID: <CAEZPtU5nxedH=y1riLmdKC5y3xRzLat+v3V2V5J_gCHRATLi8Q@mail.gmail.com>
To: Stanislav Malyshev <smalyshev@gmail.com>
Cc: Sammy Kaye Powers <me@sammyk.me>, Leigh <leight@gmail.com>, Tom Worster <fsb@thefsb.org>, 
	php-internals <internals@lists.php.net>
Content-Type: text/plain; charset=UTF-8
Subject: Re: [PHP-DEV] [RFC] [DISCUSSION] Reliable user-land CSPRNG
From: pierre.php@gmail.com (Pierre Joye)

On Thu, Feb 26, 2015 at 12:48 AM, Stanislav Malyshev
<smalyshev@gmail.com> wrote:
> Hi!
>
>> I'm cool with that idea but I also think it should be spelled out like `
>> random_crypto_*()` as Pierre suggests. I like `secure_random_bytes()` but
>> that's because it's what Ruby names their CSPRNG. :)
>
> The custom is that the first word names the function group (yes, I know
> old functions do not follow it, but this is new one). Unless we're going
> to introduce a group of functions called secure_*, random_* is a natural
> choice. I would be careful with using words like "secure", "crypto" etc.
> in general because they may be easily misunderstood - something like
> random_bytes() would do as well I think.

I agree. It should (and it is the case in the RFC) starts with
random_. As of "crypto", it is something different here as it does
match what it actually does, provides crypto safe PRNG. And the term
"crypto safe" is a well defined term. Yes, many users confuse "good",
"strong" and "crypto safe", but this is a documentation and education
issue and we should not invent new wording for industry standards.


-- 
Pierre

@pierrejoye | http://www.libgd.org