# RFC: RNG fixes and changes - Status: Implemented (PHP 7.1) - Authors: Leigh T leigh@php.net - Date: 2016-05-03 - Version: 1.0 - Original: https://wiki.php.net/rfc/rng_fixes - Page: https://externals.io/rfc/rng_fixes - More for agents: search with https://externals.io/search.md?q={query} · RFCs at https://externals.io/rfc.md · JSON API at https://externals.io/api · documentation at https://externals.io/llms.txt ## Votes ### Fix mt_rand() implementation (closed) Yes: 19 · No: 5 Voters: bishop (Yes), cmb (Yes), colinodell (Yes), derick (No), eliw (Yes), galvao (Yes), guilhermeblanco (Yes), hywan (Yes), jhdxr (Yes), kguest (Yes), kinncj (Yes), leigh (Yes), mariano (Yes), mbeccati (No), mike (Yes), nikic (Yes), ocramius (Yes), pajoye (No), peehaa (Yes), svpernova09 (Yes), trowski (Yes), tularis (Yes), tyrael (No), zimt (No) ### Alias rand() to mt_rand() (closed) Yes: 21 · No: 4 Voters: bishop (Yes), cmb (No), colinodell (No), derick (Yes), eliw (Yes), galvao (Yes), guilhermeblanco (Yes), hywan (Yes), jhdxr (Yes), kguest (Yes), kinncj (No), leigh (Yes), mariano (Yes), mbeccati (Yes), mike (No), nikic (Yes), ocramius (Yes), pajoye (Yes), peehaa (Yes), stas (Yes), svpernova09 (Yes), trowski (Yes), tularis (Yes), tyrael (Yes), zimt (Yes) ### Fix RAND_RANGE() (closed) Yes: 25 · No: 0 Voters: bishop (Yes), cmb (Yes), colinodell (Yes), derick (Yes), eliw (Yes), galvao (Yes), guilhermeblanco (Yes), hywan (Yes), jhdxr (Yes), kguest (Yes), kinncj (Yes), leigh (Yes), mariano (Yes), mbeccati (Yes), mike (Yes), nikic (Yes), ocramius (Yes), pajoye (Yes), peehaa (Yes), stas (Yes), svpernova09 (Yes), trowski (Yes), tularis (Yes), tyrael (Yes), zimt (Yes) ### Replace insecure uses of php_rand() with php_random_bytes() (closed) Yes: 23 · No: 0 Voters: bishop (Yes), cmb (Yes), colinodell (Yes), eliw (Yes), galvao (Yes), guilhermeblanco (Yes), hywan (Yes), jhdxr (Yes), kguest (Yes), kinncj (Yes), leigh (Yes), mariano (Yes), mbeccati (Yes), mike (Yes), nikic (Yes), ocramius (Yes), peehaa (Yes), stas (Yes), svpernova09 (Yes), trowski (Yes), tularis (Yes), tyrael (Yes), zimt (Yes) ### Make array_rand() more efficient (closed) Yes: 24 · No: 0 Voters: bishop (Yes), cmb (Yes), colinodell (Yes), eliw (Yes), galvao (Yes), guilhermeblanco (Yes), hywan (Yes), jhdxr (Yes), kguest (Yes), kinncj (Yes), leigh (Yes), mariano (Yes), mbeccati (Yes), mike (Yes), nikic (Yes), ocramius (Yes), pajoye (Yes), peehaa (Yes), stas (Yes), svpernova09 (Yes), trowski (Yes), tularis (Yes), tyrael (Yes), zimt (Yes) ## Discussions on the mailing list - [\[RFC\] RNG fixes](https://externals.io/message/93959.md) — started on 2016-06-14, 74 messages - [\[RFC\]\[VOTE\] RNG fixes](https://externals.io/message/94407.md) — started on 2016-07-07, 16 messages --- ## Introduction There are several long standing issues with random number generation that should be addressed: - Incorrect implementations - Platform-specific outputs - Poor scaling of bounded outputs - Insecure usage Some of these fixes alter the output of the RNG or change the behaviour of functions that depend on them, so it makes sense to perform all of the changes at the same time. ## Proposal There are several proposals up for discussion. - Fix the current mt\_rand() implementation, with the legacy implementation still available. - Alias rand() to mt\_rand(). - Fix RAND\_RANGE for large ranges. - Replace insecure uses of php\_rand() with php\_random\_bytes() - Make array\_rand() more efficient ##### Fix mt\_rand() implementation The implementation of `mt_rand()` in PHP contains a typo that makes it generate a different sequence of numbers to the original mt19937 implementation. [See bug #71152](https://bugs.php.net/bug.php?id=71152) [Statistical analysis](https://gist.github.com/tom--/a12175047578b3ae9ef8) suggests that the quality of the output is unaffected. As `mt_rand()` can be seeded for repeatable sequences the current implementation makes it incompatible with other systems that do use correct implementations. However fixing it also means that the sequence generated for a given seed in PHP will also now be different. The legacy implementation will be preserved and be selectable with a new `mt\_srand(int $seed \[, int $mode\])` parameter, along with new constants representing the two modes. The default will be the fixed algorithm. **Vote: Fix mt\_rand() implementation** — Yes: 19 · No: 5 (closed) ##### Alias rand() to mt\_rand() `rand()` uses the system random number generator. The output of this RNG is system dependant and on many systems produces weak random numbers. ([See bug #45301](https://bugs.php.net/bug.php?id=45301)) Aliasing it to `mt_rand()` improves the quality of the output and means the same output can be expected for a given seed regardless of platform. **Vote: Alias rand() to mt\_rand()** — Yes: 21 · No: 4 (closed) ##### Fix RAND\_RANGE() The macro used to scale the output of an RNG between two bounds is insufficient for large ranges. ([See bug #45184](https://bugs.php.net/bug.php?id=45184)) The proposed fix is to concatenate multiple outputs for ranges exceeding 32 bits, and use rejection sampling (the same as used in `random_bytes()`) to produce unbiased outputs. **Vote: Fix RAND\_RANGE()** — Yes: 25 · No: 0 (closed) ##### Replace insecure uses of php\_rand() with php\_random\_bytes() There are several instances where `rand()` is used internally in a security sensetive context - `crypt()` salt generation - SOAP HTTP auth nonce generation These instances should all be fixed to use the secure random number generator (even mcrypt which is deprecated) **Vote: Replace insecure uses of php\_rand() with php\_random\_bytes()** — Yes: 23 · No: 0 (closed) ##### Make array\_rand() more efficient It has been noted that ([array\_rand() produces weird and very uneven random distribution](http://php.net/manual/en/function.array-rand.php#117114)). As the above proposals change the output of `array_rand()` anyway, we can fix this at the same time. **Vote: Make array\_rand() more efficient** — Yes: 24 · No: 0 (closed) ## Backward Incompatible Changes A call to `srand()` or `mt_srand()` with a given seed will produce a different output in the following functions: - `mt_rand()` - `rand()` - `array_rand()` - `shuffle()` - `str_shuffle()` - `crypt()` ## Proposed PHP Version(s) 7.1 ## RFC Impact ### To SAPIs None ### To Existing Extensions This is covered in the Backward Incompatible Changes section ### To Opcache None, this is a functional change, no changes to opcodes or code generation are required. ### New Constants MT\_RAND\_MT19937 (correct implementation mode) MT\_RAND\_PHP (unofficial implementation mode) ## Open Issues None ## Proposed Voting Choices Individual votes will be held for the remaining proposals, and since minor BC breaks are introduced they will require a 2/3 majority to pass. ## Patches and Tests ## Implementation ## References ## Rejected Features None