Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:88761
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: error (pb1.pair.com: domain garfieldtech.com from 66.111.4.25 cause and error)
To: internals@lists.php.net
References: <D241C8B9.65E53%fsb@thefsb.org>
Message-ID: <561C7212.6080400@garfieldtech.com>
Date: Mon, 12 Oct 2015 21:53:06 -0500
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:38.0) Gecko/20100101
 Thunderbird/38.3.0
MIME-Version: 1.0
In-Reply-To: <D241C8B9.65E53%fsb@thefsb.org>
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Transfer-Encoding: 7bit
Subject: Re: [PHP-DEV] Port random_bytes to PHP 5
From: larry@garfieldtech.com (Larry Garfield)

On 10/12/2015 07:29 PM, Tom Worster wrote:
> Could we regard random_bytes() as a security patch rather than a new
> feature and therefore port it to PHP 5?
>
> Error handling would have to change but that should be feasible. Iirc,
> earlier commits of random_bytes() had PHP 5-like behavior on error.
>
> My motivation: it's easier to defend abandoning OpenSSL's RNG (e.g. in
> paragonie/random_compat) if we could say to Windows users stuck with
> nothing else: "Upgrade to the latest point release of PHP 5.x. It has a
> proper fix."
>
> Tom

Since there's no 5.7 release planned, you're talking about adding it in 
a 5.6.x?  What's wrong with the random_compat library as a solution for 
5.6 users?

--Larry Garfield