Re: [RFC] RNG fixes
| From: | Yasuo Ohgaki | Date: | Wed, 15 Jun 2016 03:19:28 +0000 |
| Subject: | Re: [RFC] RNG fixes | ||
| References: | 1 | Groups: | php.internals |
| Request: | Send a blank email to internals+get-93992@lists.php.net to get a copy of this message | ||
Hi Leigh,
On Wed, Jun 15, 2016 at 1:46 AM, Leigh <leight@gmail.com> wrote:
>
> The issues I want to bring up for discussion are.
>
> * Replacing mt_rand() and rand() to a strong, modern RNG.
> * Alternatively, fixing the current mt_rand() implementation to make it
> standard
> * Aliasing rand() to mt_rand() to improve output and cross-platform support
> * Fixing RAND_RANGE for large ranges.
> * Replacing insecure uses of php_rand() with php_random_bytes()
> * Making the array_rand() algorithm more efficient
>
> The RFC can be found here: https://wiki.php.net/rfc/rng_fixes
+1 in general.
There should be a way to produce compatible random sequences for
compatibility for reasonable periods, 5+ years at least. IMHO. INI
switch for this is required.
Regards,
--
Yasuo Ohgaki
yohgaki@ohgaki.net