Bug #70744 [NEW]: random_bytes() should not use linc arc4random

From: fsb at thefsb dot org Operating system: All except Windows PHP version: 7.0.0RC5 Package: *Encryption and hash functions Bug Type: Bug Bug description:random_bytes() should not use linc arc4random Description: ------------ ARC4 is known to be unsafe for use either as a stream cipher or a CSPRNG. You can read about it on Wikipedia and elsewhere. As far as I can tell, until recently, all implementations of the libc arc4random functions are based on David Mazieres 1996 implementation of ARC4. In November 2014, NetBSD replaced the cipher underneath libc's arc4random API with ChaCha20, a modern stream cipher currently considered safe. But this change hasn't made it into a NetBSD release yet. OS X, FreeBSD and OpenBSD have not yet incorporated NetBSD's source code change and I don't know if they will. So for the time being we have to assume that libc arc4random is ARC4 cipher and therefore unsafe. This code branch should be removed. https://github.com/php/php-src/blob/php-7.0.0RC5/ext/standard/random.c#L91 -- Edit bug report at https://bugs.php.net/bug.php?id=70744&edit=1 -- Try a snapshot (PHP 5.4): https://bugs.php.net/fix.php?id=70744&r=trysnapshot54 Try a snapshot (PHP 5.5): https://bugs.php.net/fix.php?id=70744&r=trysnapshot55 Try a snapshot (trunk): https://bugs.php.net/fix.php?id=70744&r=trysnapshottrunk Fixed in SVN: https://bugs.php.net/fix.php?id=70744&r=fixed Fixed in release: https://bugs.php.net/fix.php?id=70744&r=alreadyfixed Need backtrace: https://bugs.php.net/fix.php?id=70744&r=needtrace Need Reproduce Script: https://bugs.php.net/fix.php?id=70744&r=needscript Try newer version: https://bugs.php.net/fix.php?id=70744&r=oldversion Not developer issue: https://bugs.php.net/fix.php?id=70744&r=support Expected behavior: https://bugs.php.net/fix.php?id=70744&r=notwrong Not enough info: https://bugs.php.net/fix.php?id=70744&r=notenoughinfo Submitted twice: https://bugs.php.net/fix.php?id=70744&r=submittedtwice register_globals: https://bugs.php.net/fix.php?id=70744&r=globals PHP 4 support discontinued: https://bugs.php.net/fix.php?id=70744&r=php4 Daylight Savings: https://bugs.php.net/fix.php?id=70744&r=dst IIS Stability: https://bugs.php.net/fix.php?id=70744&r=isapi Install GNU Sed: https://bugs.php.net/fix.php?id=70744&r=gnused Floating point limitations: https://bugs.php.net/fix.php?id=70744&r=float No Zend Extensions: https://bugs.php.net/fix.php?id=70744&r=nozend MySQL Configuration Error: https://bugs.php.net/fix.php?id=70744&r=mysqlcfg