Bug #70150 [NEW]: $iv = mcrypt_create_iv( $rem, MCRYPT_DEV_URANDOM ); times out

From: Date: Mon, 27 Jul 2015 07:24:51 +0000
Subject: Bug #70150 [NEW]: $iv = mcrypt_create_iv( $rem, MCRYPT_DEV_URANDOM ); times out
Groups: php.bugs 
Request: Send a blank email to php-bugs+get-194743@lists.php.net to get a copy of this message 
From:             gessel at blackrosetech dot com
Operating system: FreeBSD 10.1-RELEASE #0 r285883
PHP version:      5.5.27
Package:          mcrypt related
Bug Type:         Bug
Bug description:  $iv = mcrypt_create_iv( $rem, MCRYPT_DEV_URANDOM ); times out

Description:
------------
---
From manual page: http://www.php.net/function.mcrypt-create-iv
---

MediaWiki's MWCryptRand.php calls  
 $iv = mcrypt_create_iv( $rem, MCRYPT_DEV_URANDOM );
This times out on FreeBSD without returning a value (even with
max_execution_time set to 3000).  

modifying the call to 
  $iv = mcrypt_create_iv( $rem, MCRYPT_DEV_URANDOM|MCRYPT_RAND );
returns as expected, however, the MW dev is concerned that MCRYPT_RAND
is not cryptographically secure, and that CC's note at
https://secure.php.net/manual/en/function.mcrypt-create-iv.php#117047
is
incorrect and that this piped construction will return "3" (rather than
0,1,2 or as Cory states, first attempt 1 and if that isn't available,
try 2) and with "3" will always initialize with the crytographically
insecure MCRYPT_RAND.

Test script:
---------------
$iv = mcrypt_create_iv( $rem, MCRYPT_DEV_URANDOM );


-- 
Edit bug report at https://bugs.php.net/bug.php?id=70150&edit=1
-- 
Try a snapshot (PHP 5.4):   https://bugs.php.net/fix.php?id=70150&r=trysnapshot54
Try a snapshot (PHP 5.5):   https://bugs.php.net/fix.php?id=70150&r=trysnapshot55
Try a snapshot (trunk):     https://bugs.php.net/fix.php?id=70150&r=trysnapshottrunk
Fixed in SVN:               https://bugs.php.net/fix.php?id=70150&r=fixed
Fixed in release:           https://bugs.php.net/fix.php?id=70150&r=alreadyfixed
Need backtrace:             https://bugs.php.net/fix.php?id=70150&r=needtrace
Need Reproduce Script:      https://bugs.php.net/fix.php?id=70150&r=needscript
Try newer version:          https://bugs.php.net/fix.php?id=70150&r=oldversion
Not developer issue:        https://bugs.php.net/fix.php?id=70150&r=support
Expected behavior:          https://bugs.php.net/fix.php?id=70150&r=notwrong
Not enough info:            https://bugs.php.net/fix.php?id=70150&r=notenoughinfo
Submitted twice:            https://bugs.php.net/fix.php?id=70150&r=submittedtwice
register_globals:           https://bugs.php.net/fix.php?id=70150&r=globals
PHP 4 support discontinued: https://bugs.php.net/fix.php?id=70150&r=php4
Daylight Savings:           https://bugs.php.net/fix.php?id=70150&r=dst
IIS Stability:              https://bugs.php.net/fix.php?id=70150&r=isapi
Install GNU Sed:            https://bugs.php.net/fix.php?id=70150&r=gnused
Floating point limitations: https://bugs.php.net/fix.php?id=70150&r=float
No Zend Extensions:         https://bugs.php.net/fix.php?id=70150&r=nozend
MySQL Configuration Error:  https://bugs.php.net/fix.php?id=70150&r=mysqlcfg

Thread (3 messages)

« previous php.bugs (#194743) next »