note 57711 added to function.mt-srand
| From: | dan at osu1 dot php dot net | Date: | Wed, 12 Oct 2005 01:33:23 +0000 |
| Subject: | note 57711 added to function.mt-srand | ||
| Groups: | php.notes | ||
| Request: | Send a blank email to php-notes+get-96876@lists.php.net to get a copy of this message | ||
For security sensitive applications, a single call to microtime() is unlikely to provide sufficient
randomness for the seed (even in combination with the process ID).
If you are running a website a good way to rack up sufficient randomness is to maintain a seed which
is updated everytime a webpage is served to any user. An example of such an update is:
<?php
$newseed = hash($oldseed.microtime());
?>
The use of a suitable hash, such as SHA2 will ensure that an attacker would have to guess the exact
time at which every page was served to reconstruct the seed. This will quickly become infeasible as
the number of pages served increases.
(Nb. For the interested, I've written a bit more about this method here: http://dmossop.zeeblo.com/?p=35 ).
----
Manual Page -- http://www.php.net/manual/en/function.mt-srand.php
Edit -- http://master.php.net/manage/user-notes.php?action=edit+57711
Delete: added to the manual -- http://master.php.net/manage/user-notes.php?action=delete+57711&report=yes&reason=added+to+the+manual
Delete: bad code -- http://master.php.net/manage/user-notes.php?action=delete+57711&report=yes&reason=bad+code
Delete: spam -- http://master.php.net/manage/user-notes.php?action=delete+57711&report=yes&reason=spam
Delete: useless -- http://master.php.net/manage/user-notes.php?action=delete+57711&report=yes&reason=useless
Delete: non-english -- http://master.php.net/manage/user-notes.php?action=delete+57711&report=yes&reason=non-english
Delete: already in docs -- http://master.php.net/manage/user-notes.php?action=delete+57711&report=yes&reason=already+in+docs
Delete: other reasons -- http://master.php.net/manage/user-notes.php?action=delete+57711&report=yes
Reject -- http://master.php.net/manage/user-notes.php?action=reject+57711&report=yes
Search -- http://master.php.net/manage/user-notes.php