Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:94381
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.218.42 as permitted sender)
MIME-Version: 1.0
In-Reply-To: <CAGa2bXa3o4FzQDGyU+=XHWoH59QjTJdJcjwch4=VdUUC7ZsD=w@mail.gmail.com>
References: <CAGa2bXaSkozJLLtycujwmHyas9TofRw5s6JzG0EQQvPyU0pxNQ@mail.gmail.com>
	<CAGa2bXZ=DiqQ4PozYntvGApZHdkjWyTBQhk_Udy5Y3_m0ry9Lw@mail.gmail.com>
	<a32232d3-006b-a7c2-0aa8-7f44509dfe69@gmail.com>
	<CAGa2bXa3o4FzQDGyU+=XHWoH59QjTJdJcjwch4=VdUUC7ZsD=w@mail.gmail.com>
Date: Tue, 5 Jul 2016 10:02:58 +0700
Message-ID: <CAEZPtU5RRGbUXJE7cHd2LuUmF5hiGDJAhGNKZ+_nRj1d+pHkZA@mail.gmail.com>
To: Yasuo Ohgaki <yohgaki@ohgaki.net>
Cc: danack@php.net, PHP internals <internals@lists.php.net>, 
	Stanislav Malyshev <smalyshev@gmail.com>
Content-Type: multipart/alternative; boundary=001a11c15d9ea974790536dab06d
Subject: Re: [PHP-DEV] Re: [RFC][VOTE] Session ID without hashing
From: pierre.php@gmail.com (Pierre Joye)

--001a11c15d9ea974790536dab06d
Content-Type: text/plain; charset=UTF-8

On Jul 5, 2016 6:14 AM, "Yasuo Ohgaki" <yohgaki@ohgaki.net> wrote:
>
> Hi Stas,
>
> Thank you for sharing opinion.
> Followings is mine.
>
> On Tue, Jul 5, 2016 at 7:23 AM, Stanislav Malyshev <smalyshev@gmail.com>
wrote:
> >> Could you share the reason why against this change?
> >
> > 1. I'm not sure exporting raw generator state is a good practice. I may
> > change my opinion on the subject if I hear from some security people
> > (I'm no crypto expert) that this is ok, then I may change my opinion.
>
> I think no one can guarantee security of CSPRNG on all platforms.
>
> "CS" means cryptographic safety and cryptographers recommends
> not to reinvent crypt related functions/features.
>
> > 2. Due to (1), I do not think it makes sense to do this change, because
> > we produce no benefit (session generation speed is not that important
> > since nobody generates millions of sessions at once) and create
> > potential problems.
>
> Current implementation is regenerating random hash string by using
>
>  - PID
>  - Time (Simple random function)
>  - CSPRNG when it is available

For clarification, it is always available. Php requires a valid one to be
built.

We can argue about the provided pnrng being CS but it is not php's job to
decide.

--001a11c15d9ea974790536dab06d--