Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:92151
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.192.172 as permitted sender)
To: Yasuo Ohgaki <yohgaki@ohgaki.net>,
 "internals@lists.php.net" <internals@lists.php.net>
References: <CAGa2bXY3Zdrq-vU6_gCJVC3smP7DooBsKFNmQpz=ksdKsQORbQ@mail.gmail.com>
Message-ID: <5706EEF3.3050705@gmail.com>
Date: Thu, 7 Apr 2016 16:36:19 -0700
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:38.0)
 Gecko/20100101 Thunderbird/38.7.1
MIME-Version: 1.0
In-Reply-To: <CAGa2bXY3Zdrq-vU6_gCJVC3smP7DooBsKFNmQpz=ksdKsQORbQ@mail.gmail.com>
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: 7bit
Subject: Re: [PHP-DEV] [RFC][DISCUSSION] Session ID without hashing
From: smalyshev@gmail.com (Stanislav Malyshev)

Hi!

> Session module does not require hashing to generate session ID. This
> RFC removes hashing from session module and enable use_strict_mode as
> an insurance for broken RNG.
> 
> https://wiki.php.net/rfc/session-id-without-hashing

I'm not sure why that should be the default. First of all, I'm not sure
exporting the state of the PRNG is that good an idea, there may be
vulnerability in the PRNG that could be opened (or made easier) for
exploit with direct access to its output. I'd rather not provide this
opening unnecessarily. Second, I do not see why we need to do maximum
breakage change if we could just make an identity "hash" function and
support both cases. "Session generation performance" does not have a lot
of meaning here - I'd be very surprised to see any application that is
bound by the speed of generating session IDs.

Also, I don't see how use_strict_mode change is related to the hashing.
Could you explain?
-- 
Stas Malyshev
smalyshev@gmail.com