Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:94328
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.220.174 as permitted sender)
MIME-Version: 1.0
Sender: yohgaki@gmail.com
In-Reply-To: <3dd66d47-9196-f1fd-82b6-ee0039c4da0d@gmail.com>
References: <CAGa2bXY3Zdrq-vU6_gCJVC3smP7DooBsKFNmQpz=ksdKsQORbQ@mail.gmail.com>
 <CAGa2bXaCLYTxSOuHHabYZSd=O07K5WU-fonki_5GNgWP=rNctg@mail.gmail.com> <3dd66d47-9196-f1fd-82b6-ee0039c4da0d@gmail.com>
Date: Thu, 30 Jun 2016 05:59:51 +0900
Message-ID: <CAGa2bXY=E06Zg8PX2Jryq9GTwH+mvK3sfqku9YXLVpMX19fOGg@mail.gmail.com>
To: Stanislav Malyshev <smalyshev@gmail.com>
Cc: "internals@lists.php.net" <internals@lists.php.net>
Content-Type: text/plain; charset=UTF-8
Subject: Re: [PHP-DEV] Re: [RFC][DISCUSSION] Session ID without hashing
From: yohgaki@ohgaki.net (Yasuo Ohgaki)

Hi Stas,

On Wed, Jun 29, 2016 at 9:09 AM, Stanislav Malyshev <smalyshev@gmail.com> wrote:
>
>> Concern has been discussed is risk of broken PRNG and predictable
>> session ID. We may insist any platform must have reliable PRNG, but it
>> would be good idea to have least mitigation. Reading extra bytes
>> should be good enough for this purpose.
>
> I still see no reason to change it stated in the RFC except performance
> (which is irrelevant in all contexts I know of). It states the change
> but omits the reason why this change is necessary. Could you please add
> that part?

Sure.
The main purpose is clean up.

The reason we have messy session ID creation code for hashing and
generating random bytes is we didn't have reliable cross platform PRNG
code. We have it now, so no reason to keep complex/redundant/inefficient code.

I'll add this.

Thank you.

--
Yasuo Ohgaki
yohgaki@ohgaki.net