Re: Security changes in PHP 7

Hi Tom, On Sun, Feb 8, 2015 at 4:24 AM, Tom Worster <fsb@thefsb.org> wrote: > 1. Will there be a portable API for getting random bytes from the > platform's CSPRNG? > > https://wiki.php.net/ideas/php6 lists as an addition: > "Reliable, > userfriendly RNG APIs: Provide a userfriendly and reliable RNG APIs, > available by default, on all supported platforms and for all usages > (from weak to crypto safe)." > Pierre, What the status? > 2. What's going to happen to mcrypt? > > I see the vote to excise it did not pass. Does this mean that (i.e. > imply that) PHP's plan is to keep a security lib that hasn't been > maintained for 8 years for the next 5+ years? > Removed. Available as PECL module. Probably. > > > 3. Will the OpenSSL ext remain as it currently stands? > > There have been a few discussions about this but I'm not clear if any > decisions have been made about changing it or providing a new API. > Not sure on this > > > 4. What does openssl_random_pseudo_bytes() really do in PHP? > > Where does it get random bytes from in the various different platforms? > Is it going to change in PHP 7? > It's depend on openssl. What openssl does is what it does. > > > 5. Is the weird Linux /dev/random[1] still supported? If so, is used > by default in any PHP API? > Session module use it. /dev/urandom or /dev/arundom > > > 6. I noticed some work on constant-time functions. Is this for security > purposes, i.e. defeating remote timing attacks? Is there an RFC? > > > No, but there is patch. Status? Regards, -- Yasuo Ohgaki yohgaki@ohgaki.net