Newsgroups: php.internals Path: news.php.net Xref: news.php.net php.internals:97846 Return-Path: Mailing-List: contact internals-help@lists.php.net; run by ezmlm Delivered-To: mailing list internals@lists.php.net Received: (qmail 70103 invoked from network); 18 Jan 2017 00:45:24 -0000 Received: from unknown (HELO lists.php.net) (127.0.0.1) by localhost with SMTP; 18 Jan 2017 00:45:24 -0000 Authentication-Results: pb1.pair.com header.from=yohgaki@ohgaki.net; sender-id=pass Authentication-Results: pb1.pair.com smtp.mail=yohgaki@ohgaki.net; spf=pass; sender-id=pass Received-SPF: pass (pb1.pair.com: domain ohgaki.net designates 180.42.98.130 as permitted sender) X-PHP-List-Original-Sender: yohgaki@ohgaki.net X-Host-Fingerprint: 180.42.98.130 ns1.es-i.jp Received: from [180.42.98.130] ([180.42.98.130:37878] helo=es-i.jp) by pb1.pair.com (ecelerity 2.1.1.9-wez r(12769M)) with ESMTP id D2/42-00729-2AABE785 for ; Tue, 17 Jan 2017 19:45:24 -0500 Received: (qmail 13808 invoked by uid 89); 18 Jan 2017 00:45:19 -0000 Received: from unknown (HELO mail-wm0-f52.google.com) (yohgaki@ohgaki.net@74.125.82.52) by 0 with ESMTPA; 18 Jan 2017 00:45:19 -0000 Received: by mail-wm0-f52.google.com with SMTP id r144so886705wme.1 for ; Tue, 17 Jan 2017 16:45:18 -0800 (PST) X-Gm-Message-State: AIkVDXL3uBiR1uo6ZSSNopPsc3cQyqytW9hi/s6DtaHPMjjqyuGspep08uKbx3GmbgCDjWvgVe1+fv9dXi3XJA== X-Received: by 10.28.57.193 with SMTP id g184mr572299wma.122.1484700312405; Tue, 17 Jan 2017 16:45:12 -0800 (PST) MIME-Version: 1.0 Received: by 10.195.12.8 with HTTP; Tue, 17 Jan 2017 16:44:31 -0800 (PST) In-Reply-To: <7a359bb08b0ad8b046534c15492cec91@gmail.com> References: <71c26cd6df6f59e76dafd31647852c2e@koti.fimnet.fi> <142a3537a99809cf23d78e0eaadc3aef@gmail.com> <7a359bb08b0ad8b046534c15492cec91@gmail.com> Date: Wed, 18 Jan 2017 09:44:31 +0900 X-Gmail-Original-Message-ID: Message-ID: To: =?UTF-8?Q?Lauri_Kentt=C3=A4?= Cc: "internals@lists.php.net" Content-Type: multipart/alternative; boundary=001a114a4826b810ae054653ba34 Subject: Re: [PHP-DEV] Re: Improving mt_rand() seed From: yohgaki@ohgaki.net (Yasuo Ohgaki) --001a114a4826b810ae054653ba34 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable Hi Lauri, On Tue, Jan 17, 2017 at 11:59 PM, Lauri Kentt=C3=A4 wrote: > On 2017-01-17 16:18, Lauri Kentt=C3=A4 wrote: > >> On 2017-01-17 02:34, Yasuo Ohgaki wrote: >> >>> Set state somewhere between MT rand's 2^19937=E2=88=921 cycle. >>> >> >> This is exactly what my patch does. >> > > Or, to be honest, my patch provides 2^19936 possible states, > which should be more than enough. > > To get all 2^19937=E2=88=921, you would need to get one more bit of > entropy (2^19936 to 2^19937) and then check that the state is > not all zeros (which is the =E2=88=921 in 2^19937=E2=88=921). That's cert= ainly > not worth the trouble, so I just set that one "extra" bit to 1. > (MT doesn't work if the state is all zeros.) Sorry for sloppy patch reading. Your patch initialize whole BG(state) buffer by php_random_bytes(). This should be good enough. I'll merge this patch. This better automatic initialization should be included 7.0 and up. mt_rand() will at a lot stronger against dictionary attacks. Any comments, RMs? Regards, -- Yasuo Ohgaki yohgaki@ohgaki.net --001a114a4826b810ae054653ba34--