Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:87172
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: error (pb1.pair.com: domain sammykmedia.com from 209.85.212.175 cause and error)
MIME-Version: 1.0
Sender: sammyk@sammykmedia.com
Date: Tue, 14 Jul 2015 16:04:55 -0500
Message-ID: <CALYT1Yo-ae+cemXaaXs5Jv5t2DSzdxdYuxuhEGbXyoo_863+bw@mail.gmail.com>
To: PHP Internals <internals@lists.php.net>
Content-Type: multipart/alternative; boundary=f46d04428122b530cc051adc30be
Subject: Core functions throwing exceptions in PHP7
From: me@sammyk.me (Sammy Kaye Powers)

--f46d04428122b530cc051adc30be
Content-Type: text/plain; charset=UTF-8

Hello lovely PHP nerds,

There are two open PR's for PHP7 to modify the behavior of the CSPRNG's:

https://github.com/php/php-src/pull/1397 (main discussion)
https://github.com/php/php-src/pull/1398

Currently the random_*() functions will issue a warning and return false if
a good source of random cannot be found. This is a potential security hole
in the event the RNG fails and returns false which gets evaluated as 0 in a
cryptographic context.

To prevent this exploit the proposed behavior will throw an Exception when
the RNG fails or certain argument validation fails. This also gives the
developer a graceful way to fall back to an alternate CSPRNG.

Since the core functions in PHP don't throw Exceptions, there is debate on
whether or not this change should be implemented. Some say the CSPRNG's
should get a special pass since they will be relied on for cryptography. If
we can't throw Exceptions, there were suggestions of raising a fatal error
if the RNG fails.

I think the argument can be boiled down to consistency vs security. We'd
love to hear your feedback to decide what we should do in this context. :)

Thanks,
Sammy Kaye Powers
sammyk.me

Chicago, IL 60604

--f46d04428122b530cc051adc30be--