Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:83900
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.220.181 as permitted sender)
MIME-Version: 1.0
In-Reply-To: <D1149DA2.5DE3C%fsb@thefsb.org>
References: <D1138D6D.5DCE0%fsb@thefsb.org>
	<CAPwsocFtOnB_9uEJUXF-JLhrx0umeW7pKM_mYKRG2eBOM6oYwQ@mail.gmail.com>
	<CAEZPtU4Z9pSKydr-gH43nvDwtGfLTQv_RArqVk2SQg2qLoYZ2A@mail.gmail.com>
	<CAEZPtU7V_DKvrSAJZZA=OaktXpuPsGCuAzggobvSS63VUxbDTA@mail.gmail.com>
	<CALYT1Yp_szH_M=4ufwVXAng9iuva8rahqazjjZX+Br717k0urg@mail.gmail.com>
	<D1149DA2.5DE3C%fsb@thefsb.org>
Date: Thu, 26 Feb 2015 15:50:41 +0000
Message-ID: <CAPwsocFhtiqE2S+3XtesnkyyiRGgtTek7_SBU3dw59kGr45nkw@mail.gmail.com>
To: Tom Worster <fsb@thefsb.org>
Cc: Sammy Kaye Powers <me@sammyk.me>, php-internals <internals@lists.php.net>
Content-Type: text/plain; charset=UTF-8
Subject: Re: [PHP-DEV] [RFC] [DISCUSSION] Reliable user-land CSPRNG
From: leight@gmail.com (Leigh)

On 26 February 2015 at 15:04, Tom Worster <fsb@thefsb.org> wrote:
>>I actually started down this RFC path out of frustration on this very
>>point of needing secure random alphanumeric stings. The originally RFC &
>>patch contained a `random_hex()` function that would convert bytes from
>>the CSPRNG into hex.
>
> bin2hex(random_bytes(8)) is so easy i don't think a new shorthand
> function is worth it.

I can't help but notice the output of this is 16 bytes.

Please, please tell me that you don't use the output of
bin2hex(random_bytes(8)) for a key or IV. This is so dangerous and I'm
actually worried about how many people actually do this.

Apologies if this is just a coincidence, but for the benefit of
_anyone_ reading this, never ever ever (ever!), use an encoded value
for a key or IV. Not hex, not base64, not anything exotic you've
dreamed up to make things "more random". If you know a project doing
this, spread the word, this is something that needs to be fixed
through education.