Re: unify entropy source for all php related functions

Hi! On Feb 13, 2014 4:12 PM, "Yasuo Ohgaki" <yohgaki@ohgaki.net> wrote: > > > On Thu, Feb 13, 2014 at 5:46 PM, Yasuo Ohgaki <yohgaki@ohgaki.net> wrote: >>> >>> > Since it's too late for 5.6, I'll commit only to master. >>> > Does anyone think this change needs RFC? >>> >>> The entropy src needs one I think as it introduce two new ini settings. >> >> Sure. >> I don't mind creating new RFC for those 2 new INIs. >> I'll create it later for master for the time being. > > > https://wiki.php.net/rfc/unified-crypto-source > Thanks! session.entropy_file won't be deprecated but will share the same, or can share the same source. I can perfectly imagine large set oh hosts using two sources, one for session and one for user land usages. On windows they are not ignored but must be set. We can always add support for hardware RNG or servers. A couple of good ones exist but we need to test them (stream). We only support the windows crypto api for now. There will be no hard coded default values but compile time default values (as we do it now for other settings). These settings must system settings, apps should not be able to change them. The open issue can be dropped. We are not going to provide that through these settings, not now. Target is 5.6. Cheers, Pierre