Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:97986
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: softfail (pb1.pair.com: domain gmail.com does not designate 178.62.210.197 as permitted sender)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8;
 format=flowed
Content-Transfer-Encoding: 8bit
Date: Fri, 27 Jan 2017 16:30:23 +0200
To: Leigh <leight@gmail.com>
Cc: Yasuo Ohgaki <yohgaki@ohgaki.net>, Niklas Keller <me@kelunik.com>,
 Nikita Popov <nikita.ppv@gmail.com>, internals@lists.php.net
In-Reply-To: <CAPwsocFUcODbpjFQsaK3V9c9Ck=LMtk5_g_9H_DdeuyvX+t1qQ@mail.gmail.com>
References: <CAGa2bXbFST=5DkhiJ6zJ1hJ5vZYUo7CnCDp+VXcyvSU-bWcyMg@mail.gmail.com>
 <CAGa2bXak3tZ+kC6EeiA=ZCeynGSZbO-4Hpd1v_1oZVDHpSAvsA@mail.gmail.com>
 <71c26cd6df6f59e76dafd31647852c2e@koti.fimnet.fi>
 <CAGa2bXY0djrgpbC_wNGeRyciNygS59hmuaUaZG-=vAt0dZoxxA@mail.gmail.com>
 <142a3537a99809cf23d78e0eaadc3aef@gmail.com>
 <7a359bb08b0ad8b046534c15492cec91@gmail.com>
 <CAGa2bXZgbsHM-PZcSUoyA8VZ22rmMmjy41tGPUszC2Acr7Zjyw@mail.gmail.com>
 <CAF+90c9jC0r22NEPbeYXMgL8F_qm0rtJ-nXTeqj_PgjhcY6RRw@mail.gmail.com>
 <CAGa2bXaSux=Pq8+9N4wT9gaqjY--N=D9WwH0560=JEUjutd5LA@mail.gmail.com>
 <8cfe7a3ea5a05fc3e5347e9af848ada0@gmail.com>
 <CAGa2bXZzpfEuQDEcQM=eLRit8BRieW5KY5h-H59+1-P0Ehmomw@mail.gmail.com>
 <CAPwsocFypb4m7sA0An0CmJ=izZW_07PzyFVN7bN9A+q81aTEvw@mail.gmail.com>
 <CAGa2bXbn4d7tT_NG2EHzFKvMDWAr=TCPw1L26QJv7jyKE5of+w@mail.gmail.com>
 <a4a9e600b364c9cc70a4f8fcca11cdc7@gmail.com>
 <CAGa2bXZ7sOsJWkNpSRaBD-6i4mk0d4hxEmHSknf_1CT0iZ8+3g@mail.gmail.com>
 <CAGa2bXZyD4qxRpo-pKuYnpt6A2mjedKgC9_xTvSL2Ojs8y_e6Q@mail.gmail.com>
 <CANUQDChFDB604HyT4f3-FvAmbd5BjoQngT1FKG9JOtDceOv7-Q@mail.gmail.com>
 <CAPwsocEwNxskcOpX2n_t=oNCT1ntg8owmncA=NaCgTo6UqKjVw@mail.gmail.com>
 <CAGa2bXaAYE2=R+m0YbpSLJD4goWFz9tbZXU_nPdczpUUcq-=AQ@mail.gmail.com>
 <CAPwsocFUcODbpjFQsaK3V9c9Ck=LMtk5_g_9H_DdeuyvX+t1qQ@mail.gmail.com>
Message-ID: <1913d779b7954d5c099ed66821cb299c@gmail.com>
User-Agent: Roundcube Webmail/1.2.3
Subject: Re: [PHP-DEV] Re: Improving mt_rand() seed
From: lauri.kentta@gmail.com (=?UTF-8?Q?Lauri_Kentt=C3=A4?=)

On 2017-01-27 12:58, Leigh wrote:
> On 27 January 2017 at 02:52, Yasuo Ohgaki <yohgaki@ohgaki.net> wrote:
>> Since mt_rand is predictable PRNG, there is possibility to be known to
>> attackers always.
>> 
>> What I would like to change is
>> 
>>  - there is only 2^32 initial states
> 
> This needs to be thought of as 2^32 possible _streams_ with a period
> of (2^19937)−1. Offset within the stream is as important as the stream
> variation itself.

This is not true. There is one stream of period (2^19937)−1, and
the initial state defines the current position in that stream.

> Statistical testing of MT shows it to be pretty good. The ability to
> recover the state from full outputs doesn't subtract from the quality
> of the randomness. It is absolutely not a cryptographic quality
> generator, but it is a high quality source of entropy.

Do not confuse entropy and randomness. Entropy is true randomness,
as can be seen in /dev/random. There is no deterministic algorithm
for generating more entropy, so MT or even a CSPRNG has exactly
as much entropy as the seed contains.

> Even with 2^32 possible initial states every
> password generated will still have a bit strength of 2^60

If the attacker knows the algorithm, the bit strength is only 2^32.
The remaining 2^28 comes from security through obscurity, which is
not a generally valid real security thing.

Anyway, a password should be better generated with CSPRNG, not MT,
so "hardening" MT is totally irrelevant.

-- 
Lauri Kenttä