Hi Pierre,
On Fri, Feb 7, 2014 at 8:25 PM, Pierre Joye <[email protected]> wrote:
> There are a lot of additions and discussions about entropy source and
> (P)RNG lately.
>
> PHP already has a ini setting to define a strong entropy source for
> the session module, which defaults to urandom or arandom.
>
> I would like to create two settings to unify the entropy source
> accross php functions. That includes mcrypt, new password APIs,
> session, LCG, etc.
>
> Something along this line:
>
> random.entropy_strong_source (/dev/(u|a)random etc.)
> random.entropy_crypto_source (/dev/random etc.)
>
+1 for unify.
BTW, it sound more natural if names are
random.entropy_crypto_source (/dev/(u|a)random etc.)
random.entropy_strong_source (/dev/random etc.)
I feels like 'strong' > 'crypto' with this naming.
> I am not willing to propose new RNG functions or extensions for 5.6 as
> we have way too little time to actually discuss its design and APIs.
> However having these settings unified and documented would be a good
> step forward already.
>
Although, I really would like to have one, it's not much issue for me, but
a issue for average users ;)
This is possible implementation.
https://github.com/yohgaki/php-src/compare/PHP-5.6-rfc-random_bytes
It's not perfect yet, though.
Regards,
--
Yasuo Ohgaki
[email protected]