Re: Re: Improving mt_rand() seed
| From: | Lauri Kenttä | Date: | Mon, 16 Jan 2017 17:34:25 +0000 |
| Subject: | Re: Re: Improving mt_rand() seed | ||
| References: | 1 2 | Groups: | php.internals |
| Request: | Send a blank email to internals+get-97792@lists.php.net to get a copy of this message | ||
On Mon, Jan 16, 2017 at 4:04 PM, Yasuo Ohgaki <yohgaki@ohgaki.net> wrote:
Attachment: [text/x-diff] 0001-mt_rand-Seed-with-php_random_bytes.txt
We know this kind of seed is guessable. i.e. Our session id is compromised by this kind of code.Maybe you should fix session id instead of (or in addition to) mt_rand. On 2017-01-16 09:16, Yasuo Ohgaki wrote:
Comments are appreciated.Simply set BG(state)[0] to 0x80000000U and fill the rest with random. That's practically like the MT reference implementation init_by_array. See the attached patch. Feel free to commit. -- Lauri Kenttä
Attachment: [text/x-diff] 0001-mt_rand-Seed-with-php_random_bytes.txt