Re: Default mcrypt_create_iv() to /dev/urandom

HI all, On Sat, Mar 8, 2014 at 2:18 AM, Pierre Joye <pierre.php@gmail.com> wrote: > > One potential issue when using /dev/urandom is that on some systems > > (notably Linux, but not BSD) it will not block even if it can't gather > > enough initial entropy for seeding the CSPRNG and as such produce > > predicable outputs. This condition can only occur immediately after > system > > startup and as per the /dev/random man page [1] this is mitigated by "all > > major Linux distributions [...] since 2000 at least" by saving a seed > file. > > > > As such I would suggest defaulting the mcrypt_create_iv() $source > parameter > > to MCRYPT_DEV_URANDOM. Objections? > > I have no objection as uramdom is good enough for 99.999% of php usage. I have no objection neither. Pierre has proposed unified RNG/PRNG source setting. I would like to see this in 5.6 and make php.ini's PRNG the default. Mess would be growing without unified RNG/PRNG. If there is unified PRNG setting in INI, I'll take care session module to use it just like encoding settings. i.e. Specific setting has more precedence than general setting. Regards, P.S. Thank you for taking care of this, Nikita. -- Yasuo Ohgaki yohgaki@ohgaki.net