Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:94695
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: error (pb1.pair.com: domain daveyshafik.com from 209.85.216.171 cause and error)
MIME-Version: 1.0
Sender: me@daveyshafik.com
In-Reply-To: <CAGa2bXZaogaW41F71cAHAaaPKm6BY6waW1Pajp6G0Bmr524g7w@mail.gmail.com>
References: <CAGa2bXZn5HiOD6LsotYDmUJKhGxxpp0xTsMSE2bp5HO0fsCmtA@mail.gmail.com>
 <CANaX5nccP6LBVow1oaO6jzU0PRjaruRSjdhiZ8kb=071gpiUTA@mail.gmail.com>
 <CAGa2bXbnE5hwGksOb6-_1Q0aas63hyLOf6GTse+VPELA9bM=4w@mail.gmail.com> <CAGa2bXZaogaW41F71cAHAaaPKm6BY6waW1Pajp6G0Bmr524g7w@mail.gmail.com>
Date: Mon, 25 Jul 2016 00:09:37 -0700
Message-ID: <CANaX5nd2B-drEdrKdRNpY7yAt0d7HhSaiFpwphc+uXw5qRJytg@mail.gmail.com>
To: Yasuo Ohgaki <yohgaki@ohgaki.net>
Cc: "internals@lists.php.net" <internals@lists.php.net>
Content-Type: multipart/alternative; boundary=001a113f07309ac14d053870772e
Subject: Re: [PHP-DEV] [RFC][VOTE] Session ID without hashing - Reopened
From: davey@php.net (Davey Shafik)

--001a113f07309ac14d053870772e
Content-Type: text/plain; charset=UTF-8

My suggestion:

Re-start the vote, three options:

Yes, new defaults (BC Break), Yes, old defaults (no BC break), No

OR:

add a second vote to the page, with:

Use new defaults (BC Break), Use Old Defaults (No BC Break)

On Sun, Jul 24, 2016 at 6:52 PM, Yasuo Ohgaki <yohgaki@ohgaki.net> wrote:

> Hi all,
>
> I would like to ask the default session ID string preference.
>
> Details of guessing an active session ID is described in previous mail.
> Please refer it for details.
>
> On Sun, Jul 24, 2016 at 4:57 PM, Yasuo Ohgaki <yohgaki@ohgaki.net> wrote:
> > I don't mind pausing vote to have consensus on how many bits for
> > session ID string is preferred.
>
> Current default is 128 bits with 32 chars. (Hex string which has 4
> bits per char)
> Pros: Compatible with current default.
> Cons: Weaker than proposed default
>
> Proposed default is 240 bits with 48 chars. (Special form which has 5
> bits per char)
> Pros: Stronger than current default.
> Cons: Incompatible with current default.
>
> 128 bits would be strong enough with CSPRNG, while 240 bits would be
> preferred as precaution.
> Which default would you prefer?
>
> I would like to restart vote based on the result.
>
> Thank you!
>
> --
> Yasuo Ohgaki
> yohgaki@ohgaki.net
>

--001a113f07309ac14d053870772e--