Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:95328
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain thefsb.org designates 108.166.43.99 as permitted sender)
To: Lester Caine <lester@lsces.co.uk>, internals@lists.php.net
References: <CAGa2bXaZhfXbU6N0-JGVPzkkxRdkcjEhkHP+YrQNH=XFX714-Q@mail.gmail.com>
 <CAPwsocFAMofROQE-OBfNiR4yrKKSss_owu0svu+Db66DmRbShw@mail.gmail.com>
 <CAGa2bXaxRA91q+ev-X3okKpNC=s3XEwC9deUYikTaUQPfOE-JQ@mail.gmail.com>
 <cc719c6c-598d-b103-96bf-eb3714a61365@thefsb.org>
 <CAGa2bXYNExeQLug=co8G1g+fdy6BXK9UbeyGkjss5s62R00Fdg@mail.gmail.com>
 <D3D49F41.70F4A%fsb@thefsb.org>
 <CAGa2bXYa-6gpyUH_yXwoob8aZA_UVjuRfzbrMxfdUp7j5jk8EQ@mail.gmail.com>
 <592333a7-2c73-38a4-b400-f3f2c7bf2f72@lsces.co.uk>
 <CAGa2bXYuO+y155BHG1hZSO75TzZqkH1RyU6C6jigEo9_goJoBA@mail.gmail.com>
 <CAGa2bXZoPtZ4anU=Q2RsgVssLW5O+a8f_-4sKAGj==MvJNrJ_g@mail.gmail.com>
 <c098dc4e-4d54-18d6-6c20-be4d3bee5c47@thefsb.org>
 <CAGa2bXa8kmdLDd8BqbB0dFTwSu4MAswxV26Tjm05ipHhiYoN8g@mail.gmail.com>
 <CAGa2bXYmtEGJJWtNW3J1oZzrny05PY7n6ns-SZ90R4DGYWN2iw@mail.gmail.com>
 <D3D87889.71240%fsb@thefsb.org>
 <c11851b1-d6d8-3380-4eb4-52856619d248@lsces.co.uk>
Message-ID: <9a3a8cb3-a3ad-b4ec-e88c-b610abe32c7f@thefsb.org>
Date: Fri, 19 Aug 2016 15:40:13 -0400
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.10; rv:45.0)
 Gecko/20100101 Thunderbird/45.2.0
MIME-Version: 1.0
In-Reply-To: <c11851b1-d6d8-3380-4eb4-52856619d248@lsces.co.uk>
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Transfer-Encoding: 7bit
Subject: Re: [PHP-DEV] [RFC][VOTE] Add session_create_id() function
From: fsb@thefsb.org (Tom Worster)

On 8/16/16 10:51 AM, Lester Caine wrote:
> On 16/08/16 13:08, Tom Worster wrote:
>>>> The default 128 bits Session ID is large enough to ignore collisions
>>>> https://wiki.php.net/rfc/session-create-id#discussions
>>>>
>>>> It describes for an application, but PHP is a platform.
>>>> There are millions PHP apps or more and there could be billions of
>>>> active sessions. There could be tens of thousands new session IDs or
>>>> more are created. Apply the calculation for expected time of possible
>>>> collision.
>>>>
>>>> Do you still sure "There will be no collisions at all"?
>> The calculation underestimates the difficulty of finding collisions by 38
>> decimal orders of magnitude. The number of different SIDs in default PHP
>> config is 2^192, not 2^64. So yes, I am still sure.
>
> In a distributed system which would be required to handle millions of
> sessions at the same time, then one will have thousands of copies of PHP
> running and shared via some sort of traffic manager. So unless some sort
> of mechanism is included to provide identification of the PHP instance
> then it is probable that different instances will all produce the same
> sequence of numbers. A UUID generator provided to ensure every
> distributed service has a uniquely identifiable id for every 'session'
> is not something that forms part of a single instance of PHP. It must be
> centrally managed with a central session store. All that a single
> instance of PHP should be worrying about is a few hundred active sessions?

(I think you could use a hash for this. But that's beside the point 
because...)

I have no problem with session_create_id().

I have a problem with saying that CSPRNG is so untrustworthy that users 
must find ways to compensate for its faults in their code.

And I have a problem with a statement to this effect being in the RFC. 
And with that statement obscuring the crux of the argument with 
misleading math about an SID database.

Tom