Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:89021
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.212.171 as permitted sender)
MIME-Version: 1.0
Date: Fri, 30 Oct 2015 19:48:33 +0000
Message-ID: <CAPwsocFbM1wYzNni_M02Vd4m4giVeH36RH8uhWfC-uk_uaSqNw@mail.gmail.com>
To: internals@lists.php.net
Content-Type: multipart/alternative; boundary=089e0112c50c06fc43052357b7b6
Subject: Make sessions use php_random_bytes in 7.1
From: leight@gmail.com (Leigh)

--089e0112c50c06fc43052357b7b6
Content-Type: text/plain; charset=UTF-8

Hi all,

I would like to refactor session id generation to use our new
php_random_bytes API as the single entropy source for session ids,
targeting 7.1

Overall this would give a small performance increase to session generation,
a large security increase to session generation, and remove some points of
possible user error.

There are a few things to consider while doing this:

session.entropy_file will no longer needed, as the best source of random
for the operating system will be selected.

session.entropy_length should be ignored, as this was to specify the length
of *additional* entropy, and may be non-zero in legacy configuration files,
that are preserved across upgrades

session.hash_function should be deprecated, there is no benefit to hashing
cryptographically strong random bytes, however people may be relying on
this to get session ids of a certain length.

We will have to introduce a new setting to control session id length,
perhaps overridden if session.hash_function is non-default. We have a year
to play with the details.

I'd like to hear if there are any strong objections to this proposal.

Cheers,

Leigh.

--089e0112c50c06fc43052357b7b6--