OpenSSL random pseudo bytes

2008/9/2 Scott MacVicar scott@macvicar.net:

Hi All,

Attached and uploaded [1] is a patch to add the OpenSSL random pseudo byte
function, at the moment it will return FALSE if the bytes aren't considered
cryptographically strong, I am however considering making this parameter
controlled.

Any objections to me applying this to 5.3?

I'd say that 5.3 should be a rather "stable" version and that if we
add features we should make sure they are rock solid now. Perhaps
adding the control (Parameter to control the security/cryptography
level) now would save time and would make it a thing less to look back
in the future.

What do you think?

Slan,
David

Hi All,

Attached and uploaded [1] is a patch to add the OpenSSL random
pseudo byte function, at the moment it will return FALSE if the
bytes aren't considered cryptographically strong, I am however
considering making this parameter controlled.

Any objections to me applying this to 5.3?

If we do end up having an alpha3, this patch can be applied along with
the of the other openssl patches. If we move to beta for the next
5.3.0 release, then I would rather prefer to keep this change out
until 5.3.1. Lets wait what happens with the namespace discussion this
week. Johannes and I will then decide if we do alpha3 or beta1 next
over the weekend and publish a schedule next Monday.

regards,
Lukas Kahwe Smith
mls@pooteeweet.org

hi Scott,

Hi All,

Attached and uploaded [1] is a patch to add the OpenSSL random pseudo byte
function, at the moment it will return FALSE if the bytes aren't considered
cryptographically strong, I am however considering making this parameter
controlled.

Any objections to me applying this to 5.3?

As the idea is good and usefull, I have to object to expose this function.

There is already a todo entry for our random functions (mt and normal
rand) as well as a bug report. Two main issues have to be fixed there,
the entropy and the actual randomness. The same underlying API is used
and we can then add a function to return a random buffer directly
(which is basically what is done internally too).

Cheers,

Pierre

http://blog.thepimp.net | http://www.libgd.org

Scott MacVicar escribió:

Hi All,

Attached and uploaded [1] is a patch to add the OpenSSL random pseudo
byte function, at the moment it will return FALSE if the bytes aren't
considered cryptographically strong, I am however considering making
this parameter controlled.

Any objections to me applying this to 5.3?

Scott

[1] - http://whisky.macvicar.net/patches/openssl_prg.patch.txt

What is the status of this ? I see nothing that can break with this
patch, but I would suggest the function to take the second argument by
value instead of by reference, valid code like

<?php

$activation_code = md5(openssl_random_pseudo_bytes(128, true));

?>

causes a Fatal error: Only variables can be passed by reference...

--
"A computer is like an Old Testament god, with a lot of rules and no
mercy. "

Cristian Rodríguez R.
Platform/OpenSUSE - Core Services
SUSE LINUX Products GmbH
Research & Development
http://www.opensuse.org/