note 92847 deleted from function.mcrypt-create-iv by danbrown
| From: | danbrown@php.net | Date: | Tue, 11 Aug 2009 18:53:56 +0000 |
| Subject: | note 92847 deleted from function.mcrypt-create-iv by danbrown | ||
| References: | 1 | Groups: | php.notes |
| Request: | Send a blank email to php-notes+get-159341@lists.php.net to get a copy of this message | ||
Note Submitter: Mark Seecof
----
The official documentation above is outdated and misleading. It does not match the actual behaviour
of the function on PHP 5.3+.
On PHP 5.3+ you may set the '$source' argument to MCRYPT_DEV_RANDOM or MCRYPT_DEV_URANDOM
on ANY platform, including Windows, to get data from the host operating-system pseudorandom number
generator (/dev/{random,urandom} on *nix, CryptGenRandom() on Windows). MCRYPT_DEV_RANDOM and
MCRYPT_DEV_URANDOM are equivalent on Windows. The host OS PRNG is almost always the best source of
pseudorandom numbers for cryptographic purposes.
If you select MCRYPT_DEV_RAND the PHP mcrypt library will use a low-entropy internal PRNG which does
NOT produce crypto-quality pseudorandom numbers!
You SHOULD use MCRYPT_DEV_URANDOM, because attempts to read /dev/random often block. If you use
MCRYPT_DEV_RANDOM your scripts will hang unpredictably when running on a *nix platform. Keep your
scripts portable, even if you mainly develop for one platform: use MCRYPT_DEV_URANDOM.