Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:93992
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.220.172 as permitted sender)
MIME-Version: 1.0
Sender: yohgaki@gmail.com
In-Reply-To: <CAPwsocFZQdU2bt0OETeJMQYBXVUkK8ygB5jTb4ML3df4GZWdVA@mail.gmail.com>
References: <CAPwsocFZQdU2bt0OETeJMQYBXVUkK8ygB5jTb4ML3df4GZWdVA@mail.gmail.com>
Date: Wed, 15 Jun 2016 12:19:28 +0900
Message-ID: <CAGa2bXbFYpkmV9Eswo6a17g0Pqs_88eJo2UXtvAnEKwCWLa08g@mail.gmail.com>
To: Leigh <leight@gmail.com>
Cc: "internals@lists.php.net" <internals@lists.php.net>
Content-Type: text/plain; charset=UTF-8
Subject: Re: [PHP-DEV] [RFC] RNG fixes
From: yohgaki@ohgaki.net (Yasuo Ohgaki)

Hi Leigh,

On Wed, Jun 15, 2016 at 1:46 AM, Leigh <leight@gmail.com> wrote:
>
> The issues I want to bring up for discussion are.
>
> * Replacing mt_rand() and rand() to a strong, modern RNG.
> * Alternatively, fixing the current mt_rand() implementation to make it
> standard
> * Aliasing rand() to mt_rand() to improve output and cross-platform support
> * Fixing RAND_RANGE for large ranges.
> * Replacing insecure uses of php_rand() with php_random_bytes()
> * Making the array_rand() algorithm more efficient
>
> The RFC can be found here: https://wiki.php.net/rfc/rng_fixes

+1 in general.
There should be a way to produce compatible random sequences for
compatibility for reasonable periods, 5+ years at least. IMHO. INI
switch for this is required.

Regards,

--
Yasuo Ohgaki
yohgaki@ohgaki.net