Newsgroups: php.internals Path: news.php.net Xref: news.php.net php.internals:97852 Return-Path: Mailing-List: contact internals-help@lists.php.net; run by ezmlm Delivered-To: mailing list internals@lists.php.net Received: (qmail 98820 invoked from network); 18 Jan 2017 09:21:00 -0000 Received: from unknown (HELO lists.php.net) (127.0.0.1) by localhost with SMTP; 18 Jan 2017 09:21:00 -0000 Authentication-Results: pb1.pair.com smtp.mail=leight@gmail.com; spf=pass; sender-id=pass Authentication-Results: pb1.pair.com header.from=leight@gmail.com; sender-id=pass Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.215.51 as permitted sender) X-PHP-List-Original-Sender: leight@gmail.com X-Host-Fingerprint: 209.85.215.51 mail-lf0-f51.google.com Received: from [209.85.215.51] ([209.85.215.51:34141] helo=mail-lf0-f51.google.com) by pb1.pair.com (ecelerity 2.1.1.9-wez r(12769M)) with ESMTP id D5/55-00729-B733F785 for ; Wed, 18 Jan 2017 04:20:59 -0500 Received: by mail-lf0-f51.google.com with SMTP id v186so5627780lfa.1 for ; Wed, 18 Jan 2017 01:20:59 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=fnWY5RHy/62vNkoIJBAISGOywPXQePReveE5pMuiTJE=; b=Ur15GwpnuwUFM14y4pUcVTNgHyZeid6JFcjj5Bh8RR/MI0VoDN3dpYhUh20JHJxOj7 y/qCS40yuS6p3gBXJ1dWC54IzmT3rB9PSv7xJDK/YUdjkkgSVl2Z950ZEv+RWDNGG6fQ jHKj43k7XQCZxm8IMC/1bthjoMhCoxxJP9rBEdifDI6NDY5gMKHDkCafvvcHe+i5vTI1 +uVY6QukECMpYTQGRzdjwomkqP/16TlBbY4sO8AK+0CRaPWKxDYfcba3/6MjmyVIAPVo mjHILz+m4FNhCPTr2DgHQUdpWh3PyEpVghSdaxgzmQMj6/W2E1hSa/YkL9PrYih4pCJ2 VbsQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=fnWY5RHy/62vNkoIJBAISGOywPXQePReveE5pMuiTJE=; b=HX4zNx1AfCmFNdznLeOFInH5hYhNhAAO7k2nWgfFIKMo8itVBjS1sJA5qyzOGyTQzm LOOpAgQD6ielXQBQ4uzW5dzIxGlWKFGl7UO1oJvlx86QfTszaIkWgQQs+Z9u5a/98M04 HHcbv3NcL42/WvMzwuM3IBfNGIm/GE/nObMpHRTd5+r/q8qBVZix7Fbt7b2ztc5m8yfA NZVjxmmjU7RWTnz5ym9AgLOxG16gLgZdbFkr0vBA4Hk0kuALesm1m62UX86FkpTZWH9w 7aVGrAtpE+y4A1uve97ROxtz6GcFbb8wYRemIAs2HHiDyJV1155bHdFwMr3E2k8NefEj T9WQ== X-Gm-Message-State: AIkVDXJSFor0sxiLvDfNILwqo5KY0nsPm/M9moltocmITZTuYrCTWUn0UgJ4F/DHwvwg513wIk/nktgF6RsObQ== X-Received: by 10.25.80.26 with SMTP id e26mr777350lfb.82.1484731256399; Wed, 18 Jan 2017 01:20:56 -0800 (PST) MIME-Version: 1.0 References: <71c26cd6df6f59e76dafd31647852c2e@koti.fimnet.fi> <142a3537a99809cf23d78e0eaadc3aef@gmail.com> <7a359bb08b0ad8b046534c15492cec91@gmail.com> In-Reply-To: Date: Wed, 18 Jan 2017 09:20:45 +0000 Message-ID: To: Yasuo Ohgaki , Nikita Popov Cc: =?UTF-8?Q?Lauri_Kentt=C3=A4?= , "internals@lists.php.net" Content-Type: multipart/alternative; boundary=94eb2c1cd1981fedf805465aeff4 Subject: Re: [PHP-DEV] Re: Improving mt_rand() seed From: leight@gmail.com (Leigh) --94eb2c1cd1981fedf805465aeff4 Content-Type: text/plain; charset=UTF-8 On Wed, 18 Jan 2017 at 06:05 Yasuo Ohgaki wrote: > It could be. I haven't read and research MT rand initialization code > carefully yet. I have, it stretches 4 bytes of seed material into 624 * 4 bytes of material. There are only 2^32 possible initial states from direct seeding. After the state has been consumed it does a "twist"-pass on the existing state, this is where the "^19937-1 period comes from. I would recommend taking 4 bytes from php_random_bytes_silent() cast to uint32_t and passed to php_mt_srand(), if php_random_bytes_silent() fails fall back to the original seeding generation mechanism (it is unlikely an adversary can know which method was used) --94eb2c1cd1981fedf805465aeff4--