Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:93427
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.192.196 as permitted sender)
To: Scott Arciszewski <scott@paragonie.com>,
 PHP Internals <internals@lists.php.net>
References: <CAKws9z2y1_0GUecbJmjzH8cBf32NDq9OUwP_0w8edMiEF+wzBA@mail.gmail.com>
Message-ID: <bd5f37ef-b66b-69f8-a9b5-c7853cfdfea7@gmail.com>
Date: Sun, 22 May 2016 01:04:57 -0400
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:45.0)
 Gecko/20100101 Thunderbird/45.1.0
MIME-Version: 1.0
In-Reply-To: <CAKws9z2y1_0GUecbJmjzH8cBf32NDq9OUwP_0w8edMiEF+wzBA@mail.gmail.com>
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: 7bit
Subject: Re: [PHP-DEV] PHP 7 CSPRNG - block on /dev/random?
From: smalyshev@gmail.com (Stanislav Malyshev)

Hi!

> Question: Is there a nonzero chance of a PHP application running at boot
> time on an older GNU/Linux machine? If so, should we adopt this "unseeded
> CSPRNG" mitigation employed by libsodium for ancient Linux kernels?
> 
> https://github.com/jedisct1/libsodium/issues/374
> https://github.com/jedisct1/libsodium/commit/c752eb55d9e9992bc38e7790128953427aa0a89f
> 
> This could be done as a security patch for PHP 7.0.x if there's any concern
> about startup entropy e.g. on embedded devices.

If they're running Linux kernel that deserves to be called "ancient",
wouldn't they also run old PHP? In any case, from the problem
description, it looks like the problem happens "on early boot". I don't
see how you can get to run PHP code before you get way, way beyond early
boot.

> I'm not aware of any such projects being written in PHP, so my intuition is
> this is a non-issue for us.

I agree, this appears to be non-issue for PHP.

-- 
Stas Malyshev
smalyshev@gmail.com