Bug #70150 [Opn]: $iv = mcrypt_create_iv( $rem, MCRYPT_DEV_URANDOM ); times out

Edit report at https://bugs.php.net/bug.php?id=70150&edit=1 ID: 70150 Updated by: cmb@php.net Reported by: gessel at blackrosetech dot com Summary: $iv = mcrypt_create_iv( $rem, MCRYPT_DEV_URANDOM ); times out Status: Open Type: Bug Package: mcrypt related Operating System: FreeBSD 10.1-RELEASE #0 r285883 PHP Version: 5.5.27 Block user comment: N Private report: N New Comment: MCRYPT_DEV_URANDOM|MCRYPT_RAND has the same behavior as MCRYPT_RAND, i.e. the else clause[1] will be processed. I have deleted Cory's note. [1] <https://github.com/php/php-src/blob/php-5.6.11/ext/mcrypt/mcrypt.c#L1426-L1469> Previous Comments: ------------------------------------------------------------------------ [2015-07-27 07:24:50] gessel at blackrosetech dot com Description: ------------ --- From manual page: http://www.php.net/function.mcrypt-create-iv --- MediaWiki's MWCryptRand.php calls $iv = mcrypt_create_iv( $rem, MCRYPT_DEV_URANDOM ); This times out on FreeBSD without returning a value (even with max_execution_time set to 3000). modifying the call to $iv = mcrypt_create_iv( $rem, MCRYPT_DEV_URANDOM|MCRYPT_RAND ); returns as expected, however, the MW dev is concerned that MCRYPT_RAND is not cryptographically secure, and that CC's note at https://secure.php.net/manual/en/function.mcrypt-create-iv.php#117047 is incorrect and that this piped construction will return "3" (rather than 0,1,2 or as Cory states, first attempt 1 and if that isn't available, try 2) and with "3" will always initialize with the crytographically insecure MCRYPT_RAND. Test script: --------------- $iv = mcrypt_create_iv( $rem, MCRYPT_DEV_URANDOM ); ------------------------------------------------------------------------ -- Edit this bug report at https://bugs.php.net/bug.php?id=70150&edit=1