Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:84902
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.212.180 as permitted sender)
MIME-Version: 1.0
In-Reply-To: <55055F1D.2020200@beccati.com>
References: <CALYT1YrJrGAnjVFNQ5HHpYJmFnS4W9PH7XFU557Q=aHH0Jrb2A@mail.gmail.com>
	<55055F1D.2020200@beccati.com>
Date: Sun, 15 Mar 2015 21:29:53 +0100
Message-ID: <CAF+90c_cmhKLyLBupPqT+zP573NOZkON=X+7NQbDS2SYs14Ovw@mail.gmail.com>
To: Matteo Beccati <php@beccati.com>
Cc: Sammy Kaye Powers <me@sammyk.me>, PHP Internals <internals@lists.php.net>
Content-Type: multipart/alternative; boundary=f46d0442712e964068051159984c
Subject: Re: [PHP-DEV] [RFC] [VOTE] Vote open for reliable user-land CSPRNG
From: nikita.ppv@gmail.com (Nikita Popov)

--f46d0442712e964068051159984c
Content-Type: text/plain; charset=UTF-8

On Sun, Mar 15, 2015 at 11:29 AM, Matteo Beccati <php@beccati.com> wrote:

> On 15/03/2015 04:23, Sammy Kaye Powers wrote:
>
>> A two week discussion period has been held for the reliable user-land
>> CSPRNG RFC to add `random_bytes()` and `random_int()`. The RFC has now
>> been
>> moved into voting.
>>
>> https://wiki.php.net/rfc/easy_userland_csprng
>>
>> There was some discussion of prefixing the function names with
>> `crypto_*()`
>> but there are a few reasons we decided against this:
>>
>> 1) There is a crypto pecl extension, so the pseudo-namespace might cause
>> confusion.
>> 2) We want to work on a fully featured crypto framework for 7.1, and
>> crypto_* is a good prefix for that, so again, we don't want to mix things
>> up.
>>
>
> [...]
>
> Or in the poker deck example, wouldn't it be enough just to seed mt_srand
> with a crypto-secure number to remove the biasing and using mt_rand to
> shuffle the deck?
>

The problem is that when using mt_rand - even if you seeded it with a
cryptographic random number - you will be able to predict all future random
numbers based on the first few. The tiny 32bit seed space can be easily
brute forced. MT also allows directly recovering the full internal state
from the output, though that requires a relatively large amount of values
(624 if not truncated) and as such isn't practical for the Poker case.

Nikita

--f46d0442712e964068051159984c--