note 108479 added to function.mcrypt-create-iv

This does NOT generate randomly distributed IV's on all systems and therefore poses a big security risk. Using a script (based on the one that Alex Khimch's posted on the rand() page) one can easily check this: <?php $td = mcrypt_module_open (MCRYPT_RIJNDAEL_256, "", MCRYPT_MODE_CBC, ""); $iv = mcrypt_create_iv (mcrypt_enc_get_iv_size ($td), MCRYPT_DEV_RANDOM); // header("Content-type: image/png"); $img = imagecreatetruecolor(255,255); $ink = imagecolorallocate($img,255,255,255); for($i=0;$i<255;$i++) { for($j=0;$j<255;$j++) { $twobytes = substr ($iv, 0, 2); $iv = substr ($iv, 2); if (!strlen ($iv)) $iv = mcrypt_create_iv (mcrypt_enc_get_iv_size ($td), MCRYPT_RAND); imagesetpixel($img, ord($twobytes[0]), ord($twobytes[1]), $ink); } } imagepng($img); imagedestroy($img); ?> The resulting image should show random noise, but on the windows systems I tested (running PHP 5.3.x) it showed very distinct patterns. ---- Server IP: 91.199.167.223 Probable Submitter: 83.83.203.19 ---- Manual Page -- http://www.php.net/manual/en/function.mcrypt-create-iv.php Edit -- https://master.php.net/note/edit/108479 Del: integrated -- https://master.php.net/note/delete/108479/integrated Del: useless -- https://master.php.net/note/delete/108479/useless Del: bad code -- https://master.php.net/note/delete/108479/bad+code Del: spam -- https://master.php.net/note/delete/108479/spam Del: non-english -- https://master.php.net/note/delete/108479/non-english Del: in docs -- https://master.php.net/note/delete/108479/in+docs Del: other reasons-- https://master.php.net/note/delete/108479 Reject -- https://master.php.net/note/reject/108479 Search -- https://master.php.net/manage/user-notes.php