Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:84951
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.220.44 as permitted sender)
Message-ID: <55060E3A.4040509@gmail.com>
Date: Sun, 15 Mar 2015 15:56:58 -0700
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:31.0) Gecko/20100101 Thunderbird/31.4.0
MIME-Version: 1.0
To: Matteo Beccati <php@beccati.com>, Sammy Kaye Powers <me@sammyk.me>, 
 PHP Internals <internals@lists.php.net>
References: <CALYT1YrJrGAnjVFNQ5HHpYJmFnS4W9PH7XFU557Q=aHH0Jrb2A@mail.gmail.com> <55055F1D.2020200@beccati.com>
In-Reply-To: <55055F1D.2020200@beccati.com>
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: 7bit
Subject: Re: [PHP-DEV] [RFC] [VOTE] Vote open for reliable user-land CSPRNG
From: smalyshev@gmail.com (Stanislav Malyshev)

Hi!

> I want to vote yes, but naming is something that scares me a bit.
> Without any indication that it's CSPRNG, people might start using it
> even when unnecessary, and I'd be worried about potential negative
> effects, such as exhausting the entropy pool. It's probably more of a

After reading http://www.2uo.de/myths-about-urandom/, I have hard time
seeing how "exhausting entropy pool" would be a real problem.I mean, if
running PRNG for "too long" is dangerous, wouldn't we already have much
more serious problem with encryption routines based on them which
basically do it all the time?  Maybe I don't understand the crypto
theory under this enough, in which case it may be interesting to read
something that explains how that happens and what is the actual problem
there.
-- 
Stas Malyshev
smalyshev@gmail.com