Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:93982
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain paragonie.com designates 209.85.218.51 as permitted sender)
MIME-Version: 1.0
In-Reply-To: <CANaX5ncZ4QcKNqfd=0dCVxzN-CGEYDLqOSf=Rp=AxuCfZohv3w@mail.gmail.com>
References: <CAPwsocFZQdU2bt0OETeJMQYBXVUkK8ygB5jTb4ML3df4GZWdVA@mail.gmail.com>
	<e28227a3-d5b1-b971-3362-c6d31768aa44@fleshgrinder.com>
	<dd126a62-a617-8f34-b3c6-8e7cd0df4674@gmx.de>
	<CAPwsocE6FKcKnz2Q2PJiKPbi8prxnUoSvq3UAn-UtWoX19pz=g@mail.gmail.com>
	<e4e02f09-4a29-2f25-f169-9664ae86e161@gmx.de>
	<1ee34970-76f4-e6c6-df1e-a827e3fc592d@fleshgrinder.com>
	<CANaX5ncZ4QcKNqfd=0dCVxzN-CGEYDLqOSf=Rp=AxuCfZohv3w@mail.gmail.com>
Date: Tue, 14 Jun 2016 17:20:03 -0400
Message-ID: <CAKws9z26W90mbne1B5WOLm2_amxFOVQfQ7HnGegoO1BUoxHZTw@mail.gmail.com>
To: Davey Shafik <davey@php.net>
Cc: Christoph Becker <cmbecker69@gmx.de>, Leigh <leight@gmail.com>, 
	PHP Internals <internals@lists.php.net>
Content-Type: multipart/alternative; boundary=001a113db4ba804cbd053543910f
Subject: Re: [PHP-DEV] [RFC] RNG fixes
From: scott@paragonie.com (Scott Arciszewski)

--001a113db4ba804cbd053543910f
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

On Tue, Jun 14, 2016 at 3:56 PM, Davey Shafik <davey@php.net> wrote:

> On Tue, Jun 14, 2016 at 20:13 Fleshgrinder <php@fleshgrinder.com> wrote:
>
> > On 6/14/2016 8:56 PM, Christoph Becker wrote:
> > > Yes, I'm aware of that, and that change isn't an issue for me (except
> > > maybe that it might happen in a minor version).  I was responding to
> > > Richard (Fleshgrinder) who suggested to remove rand() and mt_rand()
> > > alltogether, because there is random_int().
> > >
> >
> > I understood how you mean it. :)
> >
> > Call me ignorant but is this required in typical web applications?
> > Couldn't we move this functionality to PECL? I mean, it is required in
> > games but other than that.
> >
> > Please correct me if that is wrong!
> >
> > --
> > Richard "Fleshgrinder" Fussenegger
> >
> >
> I think as this is a BC break it should require the 2/3 majority. I do
> support fixing the RNGs though.
>
> Have you done any checks on GitHub etc to see how widespread this usage i=
s?
> I'd like to get some data on that too.
>

=E2=80=8BI don't have data, but a word of caution: Don't grep legacy crypto
libraries for use of rand() or mt_rand() for key/IV generation if you want
to feel any sense of optimism. Speaking from experience here! ;)=E2=80=8B
=E2=80=8B

Scott Arciszewski
Chief Development Officer
Paragon Initiative Enterprises <https://paragonie.com/>=E2=80=8B

--001a113db4ba804cbd053543910f--