Re: Default mcrypt_create_iv() to /dev/urandom

On Sat, Mar 8, 2014 at 1:18 AM, Yasuo Ohgaki <yohgaki@ohgaki.net> wrote: > HI all, > > On Sat, Mar 8, 2014 at 2:18 AM, Pierre Joye <pierre.php@gmail.com> wrote: >> >> > One potential issue when using /dev/urandom is that on some systems >> > (notably Linux, but not BSD) it will not block even if it can't gather >> > enough initial entropy for seeding the CSPRNG and as such produce >> > predicable outputs. This condition can only occur immediately after >> > system >> > startup and as per the /dev/random man page [1] this is mitigated by >> > "all >> > major Linux distributions [...] since 2000 at least" by saving a seed >> file. >> > >> > As such I would suggest defaulting the mcrypt_create_iv() $source >> parameter >> > to MCRYPT_DEV_URANDOM. Objections? >> >> I have no objection as uramdom is good enough for 99.999% of php usage. By the way, a very good read: http://www.2uo.de/myths-about-urandom/ pretty much covers what we have been discussing here lately :) and PHP fits in the "most of use cases" part of this post. Cheers, -- Pierre @pierrejoye | http://www.libgd.org