Edit report at http://bugs.php.net/bug.php?id=52523&edit=1
ID: 52523
User updated by: php-bugs at thequod dot de
Reported by: php-bugs at thequod dot de
Summary: mcrypt_create_iv not reliable on win: "Could not
gather sufficient random data"
Status: Assigned
Type: Feature/Change Request
Package: mcrypt related
Operating System: *
PHP Version: 5.3.3
Assigned To: pajoye
Block user comment: N
New Comment:
JFI: it gets used in Typo3 to get random data (via
generateRandomBytes).
Added in
http://github.com/typo3/typo3v4core/commit/00ce0fe45aa46b62e8aa499912c9e36483185737
Also, it appears to be blocking (at least for longer) on Linux; it takes
up to a few seconds for each call, but appears to fail instantly on
Windows.
(not sure though)
Previous Comments:
------------------------------------------------------------------------
[2010-08-03 16:16:18] paj...@php.net
Yes, it can but very unlikely. The only case where it fails on the 1st
iteration is when I do such loops in parallel.
Hard to fix and not sure it is worth the effort. One argued once about
hi traffic site, but in this exact case the system activity provides
enough rng data (not like your example).
Changing to feature request and we will see what can be done (as it is
not windows specific, the timeout request).
------------------------------------------------------------------------
[2010-08-03 16:05:11] php-bugs at thequod dot de
Yes, I expect it to be blocking, at least for a certain amount of time
(why not for the maximum execution time?).
While the endless loop is unrealistic of course, it's only meant for
demonstration; it may fail with the first call already, according to the
following (cygwin code):
while php -r "if( mcrypt_create_iv(16, MCRYPT_DEV_RANDOM) === false )
exit(1);"; do ; done
------------------------------------------------------------------------
[2010-08-03 15:55:44] paj...@php.net
It is reliable as it fits in the mcrypt main goal, crypto safe output.
However, do you expect it to be blocking like /dev/random? By blocking
that means it won't return until it gets the requested amount of random
data.
I'd to say that this example is not realistic at all, or nobody should
do that in a real world application. It is important to keep in mind
that an app will do it once per request for example, allowing the system
seed the random sources again between calls. That's almost not possible
in your example and that defeats the whole idea behind such functions.
------------------------------------------------------------------------
[2010-08-03 13:37:47] php-bugs at thequod dot de
Description:
------------
mcrypt_create_iv (or likely rather the underlying function
php_win32_get_random_bytes) is not reliable on Windows with
MCRYPT_DEV_RANDOM/MCRYPT_DEV_URANDOM.
Since 5.3.0 MCRYPT_DEV_RANDOM and MCRYPT_DEV_URANDOM became available on
Windows platforms. (http://php.net/mcrypt_create_iv)
MCRYPT_RAND will still works, as with PHP prior to 5.3.0.
Test script:
---------------
The following code should loop forever, but does not do so on Windows
(XP and Windows 7):
php -r "$i=0; while( mcrypt_create_iv(16) !== false ) {echo
($i++).'.';};"
Expected result:
----------------
Infinite loop.
Actual result:
--------------
0.1.2.3.4.5.6.7.8.9.10.11.12.13.14.15.16.17.
Fatal error: mcrypt_create_iv(): Could not gather sufficient random data
in Command line code on line 1
------------------------------------------------------------------------
--
Edit this bug report at http://bugs.php.net/bug.php?id=52523&edit=1
