Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:88782
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain thefsb.org designates 173.203.187.67 as permitted sender)
User-Agent: Microsoft-MacOutlook/14.5.5.150821
Date: Tue, 13 Oct 2015 12:56:08 -0400
To: Anthony Ferrara <ircmaxell@gmail.com>,
	PHP Internals <internals@lists.php.net>
Message-ID: <D242ABA2.65EBF%fsb@thefsb.org>
Thread-Topic: [PHP-DEV] Port random_bytes to PHP 5
References: <D241C8B9.65E53%fsb@thefsb.org>
 <561C7212.6080400@garfieldtech.com>
 <561D1266.60101@thefsb.org>
 <CAAyV7nHzcCVOTGYDpD3yKx3gBPSiT1BuKnyvd1NOD-UBBpnYyA@mail.gmail.com>
In-Reply-To: <CAAyV7nHzcCVOTGYDpD3yKx3gBPSiT1BuKnyvd1NOD-UBBpnYyA@mail.gmail.com>
Mime-version: 1.0
Content-type: text/plain;
	charset="UTF-8"
Content-transfer-encoding: 7bit
Subject: Re: [PHP-DEV] Port random_bytes to PHP 5
From: fsb@thefsb.org (Tom Worster)

On 10/13/15, 10:59 AM, "Anthony Ferrara" <ircmaxell@gmail.com> wrote:
>
>Overall, I don't think this should be ported back to 5.x
>
>First off, it's pretty late in both 5.5 and 5.6 lifetimes (5.6 is
>already up to .14).
>
>Introducing a feature this late would basically make it useless to the
>vast majority of users of those versions (since many don't upgrade, or
>use distro-pinned versions). I don't like it, but that's the truth.
>
>random_compat serves this need quite nicely, but as always there are
>non-trivial tradeoffs at play.
>
>As far as making mcrypt_create_iv more standard, why?

To reduce the motive to use OpenSSL (reduce objections to avoiding it) in
general and in random_compat in particular.


> That's what
>random_bytes() was meant to do (and does). Just encourage people to
>move forward with it and upgrade to 7...

That's actually the stance I prefer. But I wanted to explore these options
among those who know more about updating PHP itself than me. I guess
you're right that adding this at the end of 5.5 and 5.6 won't accomplish
much.

The stance I prefer is that random_compat itself can educate users.
Imagine the user that tries it out and sees the exception 'There is no
suitable CSPRNG installed on your system'. That's a teachable moment.

If this user object's "But I've got OpenSSL" then random_compat's docs can
explain why it's not considered safe and what the user can do.

Tom