Re: com php-src: Use /dev/urandom as the default mcrypt_create_iv() source: NEWS UPGRADING ext/mcrypt/mcrypt.c
| From: | Yasuo Ohgaki | Date: | Wed, 12 Mar 2014 01:38:56 +0000 |
| Subject: | Re: com php-src: Use /dev/urandom as the default mcrypt_create_iv() source: NEWS UPGRADING ext/mcrypt/mcrypt.c | ||
| References: | 1 2 3 | Groups: | php.cvs |
| Request: | Send a blank email to php-cvs+get-76452@lists.php.net to get a copy of this message | ||
Hi Nikita,
On Wed, Mar 12, 2014 at 8:05 AM, Yasuo Ohgaki <yohgaki@ohgaki.net> wrote:
> When I close my PR, I've got comment that this is not good enough.
> Although IV is not a secret, MCRYPT_RAND is better to be deprecated in
> favor of urandom.
> Could you add E_DEPRECATED for it?
>
I changed my mind.
We are better to document MCRYPT_RAND as deprecated first, then add
E_DEPRECATE in later release. I think there should be discussion for
deprecation in internals.
Regards,
--
Yasuo Ohgaki
yohgaki@ohgaki.net