Re: Re: [RFC][VOTE] Session ID without hashing

On Jul 5, 2016 6:14 AM, "Yasuo Ohgaki" <yohgaki@ohgaki.net> wrote: > > Hi Stas, > > Thank you for sharing opinion. > Followings is mine. > > On Tue, Jul 5, 2016 at 7:23 AM, Stanislav Malyshev <smalyshev@gmail.com> wrote: > >> Could you share the reason why against this change? > > > > 1. I'm not sure exporting raw generator state is a good practice. I may > > change my opinion on the subject if I hear from some security people > > (I'm no crypto expert) that this is ok, then I may change my opinion. > > I think no one can guarantee security of CSPRNG on all platforms. > > "CS" means cryptographic safety and cryptographers recommends > not to reinvent crypt related functions/features. > > > 2. Due to (1), I do not think it makes sense to do this change, because > > we produce no benefit (session generation speed is not that important > > since nobody generates millions of sessions at once) and create > > potential problems. > > Current implementation is regenerating random hash string by using > > - PID > - Time (Simple random function) > - CSPRNG when it is available For clarification, it is always available. Php requires a valid one to be built. We can argue about the provided pnrng being CS but it is not php's job to decide.