Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:96247
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain ohgaki.net designates 180.42.98.130 as permitted sender)
MIME-Version: 1.0
In-Reply-To: <CAPwsocHqbeYw=2S6EZG+5zUEWMSM5V2OoG9uLO05sbQffJ1GPw@mail.gmail.com>
References: <CAGa2bXYg1kkoYGQNr8T2oTshuqrvweefYO+EdY41w1vwUM32iQ@mail.gmail.com>
 <CAGa2bXZLB6SsC3FQyntaDy93YfG5rDigJH6GpC5dF7MZJuJ=LQ@mail.gmail.com>
 <CAGa2bXaM_rSbmSx_bPE4erG6ok1KLdXSqnJP5ngxUNBsrzu0pw@mail.gmail.com>
 <CAPwsocHhsm9Zrh=rpF=Pbct6t5wKfAa-wirGfGjmxV8pi4nttw@mail.gmail.com>
 <CAGa2bXaMMaZn1GyrnT6Bgz3xCMDkFs+YNwHoNZe_1ge5LjLPDg@mail.gmail.com>
 <CAPwsocHXhpQNCYXVN0DHj77M0cA3eAgKuStOPquNUjx=46W1Mw@mail.gmail.com>
 <CAGa2bXaEyd+Qcc7EAQwTEVJY-zD_cK37AYXfM_534YesBG0xOA@mail.gmail.com> <CAPwsocHqbeYw=2S6EZG+5zUEWMSM5V2OoG9uLO05sbQffJ1GPw@mail.gmail.com>
Date: Wed, 5 Oct 2016 19:24:06 +0900
Message-ID: <CAGa2bXZGWFW1gXx4uuAehw0MGADWPMXVuD7wsSJuAQ6f6HJv6A@mail.gmail.com>
To: Leigh <leight@gmail.com>
Cc: "internals@lists.php.net" <internals@lists.php.net>
Content-Type: text/plain; charset=UTF-8
Subject: Re: [PHP-DEV] Re: [RFC][DISCUSSION] Improve uniqid() uniqueness
From: yohgaki@ohgaki.net (Yasuo Ohgaki)

Hi Leigh,

On Wed, Oct 5, 2016 at 5:25 PM, Leigh <leight@gmail.com> wrote:
> The list was missed off of Yasuo's replies to me, replying including the
> list

Me too :)

>
> On Wed, 5 Oct 2016 at 01:07 Yasuo Ohgaki <yohgaki@ohgaki.net> wrote:
>>
>> Hi Leigh,
>>
>> On Tue, Oct 4, 2016 at 7:06 PM, Leigh <leight@gmail.com> wrote:
>> > Since we want to preserve BC
>> >
>> > entropy = random_int(0, 99999999);
>> > uniqid = strpprintf(0, "%s%08x%05x.%08d", prefix, sec, usec, entropy);
>>
>> Current entropy is _double_ from php_combined_lcg() and has 10 chars
>> length,
>> has [0-9].[0-9]{8} format.
>>
>> "F"->"d" does not work. It should be something like
>>
>> entropy = (double) random_int(0, 9999999999);
>
>
> No it shouldn't. Don't do this. It is an unnecessary conversion. The fact
> the lcg returns a double is irrelevant. What is relevant is the 8 digits in
> order to maintain BC. The 8 digits you receive from random_int will still be
> higher quality than the 10 you get from the lcg rounded to 8 places.
>
>>
>> uniqid = strpprintf(0, "%s%08x%05x.%08F", prefix, sec, usec,
>> entropy/100000000);


There is misunderstanding for the format.
The patch is made to be fully compatible with current output.

php_combined_lcg()  produces value between 1 and 0. It is multiplied
by 10, and 8 decimal numbers are used, so additional entropy is
something like

1.23456789 (10 chars)

[yohgaki@dev ~]$ php -v
PHP 5.6.26 (cli) (built: Sep 16 2016 04:36:41)
Copyright (c) 1997-2016 The PHP Group
Zend Engine v2.6.0, Copyright (c) 1998-2016 Zend Technologies
    with Zend OPcache v7.0.6-dev, Copyright (c) 1999-2016, by Zend Technologies

[yohgaki@dev ~]$ php -r 'var_dump(uniqid(), uniqid("", true));'
string(13) "57f4ce3df2ea5"
string(23) "57f4ce3df2ea81.98781982"

Current uniqid('', true) adds 1 int char + '.' + 8 decimal char.
Tricky format string, but this is what it does.

If we would like to avoid int to double conversion, we may call
php_random_int() twice. Not sure if it's worth or not, though.

Regards,

--
Yasuo Ohgaki
yohgaki@ohgaki.net