Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:94297
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.216.175 as permitted sender)
MIME-Version: 1.0
Sender: yohgaki@gmail.com
In-Reply-To: <CAGa2bXY3Zdrq-vU6_gCJVC3smP7DooBsKFNmQpz=ksdKsQORbQ@mail.gmail.com>
References: <CAGa2bXY3Zdrq-vU6_gCJVC3smP7DooBsKFNmQpz=ksdKsQORbQ@mail.gmail.com>
Date: Tue, 28 Jun 2016 19:59:00 +0900
Message-ID: <CAGa2bXaCLYTxSOuHHabYZSd=O07K5WU-fonki_5GNgWP=rNctg@mail.gmail.com>
To: "internals@lists.php.net" <internals@lists.php.net>
Content-Type: text/plain; charset=UTF-8
Subject: Re: [RFC][DISCUSSION] Session ID without hashing
From: yohgaki@ohgaki.net (Yasuo Ohgaki)

Hi all,

On Wed, Apr 6, 2016 at 2:47 PM, Yasuo Ohgaki <yohgaki@ohgaki.net> wrote:
> Session module does not require hashing to generate session ID. This
> RFC removes hashing from session module and enable use_strict_mode as
> an insurance for broken RNG.
>
> https://wiki.php.net/rfc/session-id-without-hashing
>
> Comments are appreciated!

It's been a while since last discussion.
I would like to add this change to session module at least for PHP 7.1.

Concern has been discussed is risk of broken PRNG and predictable
session ID. We may insist any platform must have reliable PRNG, but it
would be good idea to have least mitigation. Reading extra bytes
should be good enough for this purpose.

I also changed minimum length of session ID from 32 to 22 for better
compatibility. 22 is the length with MD5 hash and
hash_bits_per_character=6.

PR would be updated soon. I would like to start vote after PR update,
so please post comments if any.

Thank you.

--
Yasuo Ohgaki
yohgaki@ohgaki.net