Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:95839
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.161.182 as permitted sender)
MIME-Version: 1.0
In-Reply-To: <CAGa2bXaM8q0mwhkz+XL6jbBaVLHDZ_-Jfj0aOPUq+te=fV=wow@mail.gmail.com>
References: <CAGa2bXaM8q0mwhkz+XL6jbBaVLHDZ_-Jfj0aOPUq+te=fV=wow@mail.gmail.com>
Date: Fri, 9 Sep 2016 12:12:25 +0200
Message-ID: <CAF+90c-Yz1oynU+xarw9vwMSXuQGMW4enkXydiZj4aJ5RdTyaQ@mail.gmail.com>
To: Yasuo Ohgaki <yohgaki@ohgaki.net>
Cc: "internals@lists.php.net" <internals@lists.php.net>
Content-Type: multipart/alternative; boundary=001a114e4e740f6b9d053c106288
Subject: Re: [PHP-DEV] [RFC] Make uniqid() more unique
From: nikita.ppv@gmail.com (Nikita Popov)

--001a114e4e740f6b9d053c106288
Content-Type: text/plain; charset=UTF-8

On Fri, Sep 9, 2016 at 7:12 AM, Yasuo Ohgaki <yohgaki@ohgaki.net> wrote:

> Hi all,
>
> We all know, uniqid() is not unique at all and not safe as random ID
> at all. This would be one of the most misused function because of its
> name.
>
> https://github.com/php/php-src/blob/master/ext/standard/uniqid.c#L44
>
> Bug report for this
> https://bugs.php.net/bug.php?id=55391
>
> I would like to
>  - Enable more entropy parameter on by default
>  - Add 256 bits random value (64 chars by HEX) from
>    php_random_bytes()  instead of 1 char from php_combined_lcg()
>
> If all of us think "just fix it", then I'll just fix this in master w/o
> RFC.
>
> Any comments?
>

The problem with "fixing" this function to be cryptographically
unpredictable (rather than just unique, for a limited definition of unique)
is that it will necessarily change the size of the output, on which there
may be assumptions. A 128 bit random value is 22 chars in base64, which is
a good bit larger than the current uniqid() output.

I agree with Niklas, this function should simply be deprecated.

Nikita

--001a114e4e740f6b9d053c106288--