note 57711 deleted from function.mt-srand by nlopess
| From: | nlopess@php.net | Date: | Wed, 12 Oct 2005 08:02:08 +0000 |
| Subject: | note 57711 deleted from function.mt-srand by nlopess | ||
| References: | 1 | Groups: | php.notes |
| Request: | Send a blank email to php-notes+get-96886@lists.php.net to get a copy of this message | ||
Note Submitter: dan
----
For security sensitive applications, a single call to microtime() is unlikely to provide sufficient
randomness for the seed (even in combination with the process ID).
If you are running a website a good way to rack up sufficient randomness is to maintain a seed which
is updated everytime a webpage is served to any user. An example of such an update is:
<?php
$newseed = hash($oldseed.microtime());
?>
The use of a suitable hash, such as SHA2 will ensure that an attacker would have to guess the exact
time at which every page was served to reconstruct the seed. This will quickly become infeasible as
the number of pages served increases.
(Nb. For the interested, I've written a bit more about this method here: http://dmossop.zeeblo.com/?p=35 ).