Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:95979
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 74.125.82.41 as permitted sender)
References: <CAGa2bXYg1kkoYGQNr8T2oTshuqrvweefYO+EdY41w1vwUM32iQ@mail.gmail.com>
 <878tuxenl4.fsf@lil.giraffy.jp>
 <CAGa2bXaTydTSZniX4dUA9h_FcNaymyqfDXQJO0zx1ZDfLmvWdg@mail.gmail.com>
 <87twdlcs2j.fsf@lil.giraffy.jp>
 <CAGa2bXaziNMtNAgsJgX-BCgLL9z2WkoSaP8aNVrAgwo9MJ4WEQ@mail.gmail.com>
 <6370f3c9-0904-bac9-0f9e-e563e9af9843@gmail.com>
 <CAGa2bXaHagrquNw063jeJUX=vnnyOugMps881tbRgRaMJ2Ef-w@mail.gmail.com>
To: "internals@lists.php.net" <internals@lists.php.net>
Message-ID: <206179c0-326f-70b4-a14d-afa0859bbc66@gmail.com>
Date: Tue, 13 Sep 2016 10:47:36 +0100
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:45.0) Gecko/20100101
 Thunderbird/45.2.0
MIME-Version: 1.0
In-Reply-To: <CAGa2bXaHagrquNw063jeJUX=vnnyOugMps881tbRgRaMJ2Ef-w@mail.gmail.com>
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Transfer-Encoding: 7bit
Subject: Re: [PHP-DEV] [RFC][DISCUSSION] Improve uniqid() uniqueness
From: rowan.collins@gmail.com (Rowan Collins)

On 13/09/2016 02:07, Yasuo Ohgaki wrote:
> I pasted simple benchmark to the PR.
> New code uses about 2x cpu time on my Fedora 24. CSPRNG uses more complex
> code than php_combined_lcg(), so this is expected.

To me, this is at least as important as changing the length and 
character range of the output.


> If I encode php_random_bytes() to the same length of digits, it does
> not increase entropy space. It remains about a million (a little less
> than 10 bits).  It's too small for current baseline.

Not enough entropy for what? Can you give some concrete scenarios where 
you see this being a problem?


To me, uniqid() is useful because it is a quick way of getting a short 
string that's likely to be fairly unique. If that is its purpose, then 
making it slower, and its output longer, are not helping anybody.

If it's purpose is to be truly random, and have controllable entropy, 
etc, then we might as well deprecate it in favour of random_bytes().

Regards,
Rowan Collins
[IMSoP]