note 49313 deleted from function.mt-rand by cmb
| From: | cmb@php.net | Date: | Sun, 19 Jan 2020 08:33:21 +0000 |
| Subject: | note 49313 deleted from function.mt-rand by cmb | ||
| References: | 1 | Groups: | php.notes |
| Request: | Send a blank email to php-notes+get-213907@lists.php.net to get a copy of this message | ||
Note Submitter: mskala at ansuz dot sooke dot bc dot ca
----
Running the output of Mersenne Twister through an unkeyed secure hash is NOT a good way to make it
secure, because it'll still have a relatively small internal state which, if recovered, would
allow reproduction of the keystream. A better idea would be to encrypt the output with a keyed
encryption algorithm - but if you were going to do that, you wouldn't need a psuedorandom
number generator at all, because a counter would be just as good.