Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:84897
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.220.181 as permitted sender)
MIME-Version: 1.0
In-Reply-To: <CALwr1GnGVHKR8JCbgHqDxmb8e4jrqVA2C3gHLXeAMsURNdOWxg@mail.gmail.com>
References: <CALYT1YrJrGAnjVFNQ5HHpYJmFnS4W9PH7XFU557Q=aHH0Jrb2A@mail.gmail.com>
	<55055F1D.2020200@beccati.com>
	<CALwr1GnGVHKR8JCbgHqDxmb8e4jrqVA2C3gHLXeAMsURNdOWxg@mail.gmail.com>
Date: Sun, 15 Mar 2015 20:13:17 +0000
Message-ID: <CAPwsocGcBPfQ1z8PgcpAr40Uw2ynGU-Xq=eEytd8uki7fgt5zA@mail.gmail.com>
To: =?UTF-8?Q?P=C3=A1draic_Brady?= <padraic.brady@gmail.com>
Cc: Matteo Beccati <php@beccati.com>, Sammy Kaye Powers <me@sammyk.me>, 
	PHP Internals <internals@lists.php.net>
Content-Type: multipart/alternative; boundary=089e0115f0483663540511595dd1
Subject: Re: [PHP-DEV] [RFC] [VOTE] Vote open for reliable user-land CSPRNG
From: leight@gmail.com (Leigh)

--089e0115f0483663540511595dd1
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

On 15 March 2015 at 13:17, P=C3=A1draic Brady <padraic.brady@gmail.com> wro=
te:
>
> Were folk to use random_int() by default, it would be actually be
> considerably better than the situation today where many reach for
> mt_rand() without really considering the use case. Using a strong
> source of ints instead of a weak source still ends up with you getting
> the requested ints. There's no downside unless the source is blocking.
>

We've deliberately avoided blocking sources for this implementation.


> Using the weak source over a strong source will also get you ints, but
> without knowing the use, it has the immediate downside risk of being
> from a weak source which shouldn't be used for anything requiring
> strong randomness.
>
> So random_int() really is the best first default option to go for when
> in doubt, with some careful consideration before switching to
> mt_rand().
>
> As for exhausting the entropy pool, this is something of a
> misconception. The sources in the RFC are pseudorandom generators
> which won't exhaust the entropy pool by design.
>

I should have read your mail before replying, but at least we've said the
same thing :)

--089e0115f0483663540511595dd1--