Re: [RFC] Make uniqid() more unique
| From: | Nikita Popov | Date: | Fri, 09 Sep 2016 10:12:25 +0000 |
| Subject: | Re: [RFC] Make uniqid() more unique | ||
| References: | 1 | Groups: | php.internals |
| Request: | Send a blank email to internals+get-95839@lists.php.net to get a copy of this message | ||
On Fri, Sep 9, 2016 at 7:12 AM, Yasuo Ohgaki <yohgaki@ohgaki.net> wrote:
> Hi all,
>
> We all know, uniqid() is not unique at all and not safe as random ID
> at all. This would be one of the most misused function because of its
> name.
>
> https://github.com/php/php-src/blob/master/ext/standard/uniqid.c#L44t
> ]6ϺP❑
>
> Bug report for this
> https://bugs.php.net/bug.php?id=55391
>
> I would like to
> - Enable more entropy parameter on by default
> - Add 256 bits random value (64 chars by HEX) from
> php_random_bytes() instead of 1 char from php_combined_lcg()
>
> If all of us think "just fix it", then I'll just fix this in master w/o
> RFC.
>
> Any comments?
>
The problem with "fixing" this function to be cryptographically
unpredictable (rather than just unique, for a limited definition of unique)
is that it will necessarily change the size of the output, on which there
may be assumptions. A 128 bit random value is 22 chars in base64, which is
a good bit larger than the current uniqid() output.
I agree with Niklas, this function should simply be deprecated.
Nikita