Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:94390
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmx.de designates 212.227.17.21 as permitted sender)
To: Leigh <leight@gmail.com>, Pierre Joye <pierre.php@gmail.com>
References: <CAGa2bXaSkozJLLtycujwmHyas9TofRw5s6JzG0EQQvPyU0pxNQ@mail.gmail.com>
 <CAGa2bXZ=DiqQ4PozYntvGApZHdkjWyTBQhk_Udy5Y3_m0ry9Lw@mail.gmail.com>
 <a32232d3-006b-a7c2-0aa8-7f44509dfe69@gmail.com>
 <CAGa2bXa3o4FzQDGyU+=XHWoH59QjTJdJcjwch4=VdUUC7ZsD=w@mail.gmail.com>
 <CAEZPtU5RRGbUXJE7cHd2LuUmF5hiGDJAhGNKZ+_nRj1d+pHkZA@mail.gmail.com>
 <CAPwsocHU4Dc5YLMq_vfJsvXQseH7es4baMh-_pNJFf7aB3bKyg@mail.gmail.com>
Cc: Yasuo Ohgaki <yohgaki@ohgaki.net>, danack@php.net,
 PHP internals <internals@lists.php.net>,
 Stanislav Malyshev <smalyshev@gmail.com>
Message-ID: <e7188936-2ef1-15b0-d5e0-15c16b2c4f73@gmx.de>
Date: Tue, 5 Jul 2016 17:37:40 +0200
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:45.0) Gecko/20100101
 Thunderbird/45.1.1
MIME-Version: 1.0
In-Reply-To: <CAPwsocHU4Dc5YLMq_vfJsvXQseH7es4baMh-_pNJFf7aB3bKyg@mail.gmail.com>
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: 7bit
Subject: Re: [PHP-DEV] Re: [RFC][VOTE] Session ID without hashing
From: cmbecker69@gmx.de (Christoph Becker)

On 05.07.2016 at 16:32, Leigh wrote:

> On 5 July 2016 at 04:02, Pierre Joye <pierre.php@gmail.com> wrote:
>> We can argue about the provided pnrng being CS but it is not php's job to
>> decide.
> 
> I think we need to drop the concerns about exposing "RNG state".
> 
> A reminder of what php_random_bytes looks at (in order):
> * CryptGenRandom on Windows
> * arc4random_buf on modern BSD (where ChaCha20 is used)
> * Linux getrandom(2) syscall where available
> * /dev/urandom where available
> * Throws an exception if it cannot access one of the above

Would that imply that in this latter case sessions couldn't be used
anymore?  What would be the fallback in that case?  From a quick glance
at the current PR there appears to be none!

-- 
Christoph M. Becker