Re: [PHP-DEV] [RFC][DISCUSSION] Session ID without hashing

2016-04-13 Thread Yasuo Ohgaki
Hi Stas, On Wed, Apr 13, 2016 at 12:50 PM, Stanislav Malyshev wrote: >> Yes and no. >> Patch uses php_random_bytes(), so it uses appropriate PRNG for the system. >> php_random_bytes() is supposed to be available always. > > True, but is it always OK to export its state to anybody who asks, on > d

Re: [PHP-DEV] [RFC][DISCUSSION] Session ID without hashing

2016-04-12 Thread Stanislav Malyshev
Hi! > Yes and no. > Patch uses php_random_bytes(), so it uses appropriate PRNG for the system. > php_random_bytes() is supposed to be available always. True, but is it always OK to export its state to anybody who asks, on demand, in unlimited numbers? I'm not so sure. > Experts say secure PRNG l

Re: [PHP-DEV] [RFC][DISCUSSION] Session ID without hashing

2016-04-12 Thread Yasuo Ohgaki
Hi Stas, On Wed, Apr 13, 2016 at 1:12 AM, Stanislav Malyshev wrote: > >> PRNG like /dev/urandom is supposed to be secure, but fair point. It >> may be good idea keeping old hash based session ID just in case >> someone find vulnerability. I suppose it's unlikely with modern PRNGs, >> though. > >

Re: [PHP-DEV] [RFC][DISCUSSION] Session ID without hashing

2016-04-12 Thread Yasuo Ohgaki
Hi Andrey, On Tue, Apr 12, 2016 at 8:12 PM, Andrey Andreev wrote: > > On Tue, Apr 12, 2016 at 2:04 PM, Yasuo Ohgaki wrote: >> >> Hi Philip, >> >> On Tue, Apr 12, 2016 at 5:38 PM, Philip Hofstetter >> wrote: >> > On Tue, Apr 12, 2016 at 10:21 AM, Michael Wallner wrote: >> >> On 08/04/16 04:17,

Re: [PHP-DEV] [RFC][DISCUSSION] Session ID without hashing

2016-04-12 Thread Stanislav Malyshev
Hi! > PRNG like /dev/urandom is supposed to be secure, but fair point. It > may be good idea keeping old hash based session ID just in case > someone find vulnerability. I suppose it's unlikely with modern PRNGs, > though. That assumes we use /dev/urandom directly and it is always available on al

Re: [PHP-DEV] [RFC][DISCUSSION] Session ID without hashing

2016-04-12 Thread Andrey Andreev
Hi, On Tue, Apr 12, 2016 at 2:04 PM, Yasuo Ohgaki wrote: > Hi Philip, > > On Tue, Apr 12, 2016 at 5:38 PM, Philip Hofstetter > wrote: > > On Tue, Apr 12, 2016 at 10:21 AM, Michael Wallner wrote: > >> On 08/04/16 04:17, Yasuo Ohgaki wrote: > >> > >>> PRNG like /dev/urandom is supposed to be sec

Re: [PHP-DEV] [RFC][DISCUSSION] Session ID without hashing

2016-04-12 Thread Yasuo Ohgaki
Hi Philip, On Tue, Apr 12, 2016 at 5:38 PM, Philip Hofstetter wrote: > On Tue, Apr 12, 2016 at 10:21 AM, Michael Wallner wrote: >> On 08/04/16 04:17, Yasuo Ohgaki wrote: >> >>> PRNG like /dev/urandom is supposed to be secure, but fair point. It >>> may be good idea keeping old hash based session

Re: [PHP-DEV] [RFC][DISCUSSION] Session ID without hashing

2016-04-12 Thread Yasuo Ohgaki
Hi Michael, On Tue, Apr 12, 2016 at 5:21 PM, Michael Wallner wrote: >> PRNG like /dev/urandom is supposed to be secure, but fair point. It >> may be good idea keeping old hash based session ID just in case >> someone find vulnerability. I suppose it's unlikely with modern PRNGs, >> though. > > I'

Re: [PHP-DEV] [RFC][DISCUSSION] Session ID without hashing

2016-04-12 Thread Philip Hofstetter
Hi On Tue, Apr 12, 2016 at 10:21 AM, Michael Wallner wrote: > On 08/04/16 04:17, Yasuo Ohgaki wrote: > >> PRNG like /dev/urandom is supposed to be secure, but fair point. It >> may be good idea keeping old hash based session ID just in case >> someone find vulnerability. I suppose it's unlikely w

Re: [PHP-DEV] [RFC][DISCUSSION] Session ID without hashing

2016-04-12 Thread Michael Wallner
On 08/04/16 04:17, Yasuo Ohgaki wrote: > PRNG like /dev/urandom is supposed to be secure, but fair point. It > may be good idea keeping old hash based session ID just in case > someone find vulnerability. I suppose it's unlikely with modern PRNGs, > though. I've come to think that "unlikely" is s

Re: [PHP-DEV] [RFC][DISCUSSION] Session ID without hashing

2016-04-07 Thread Yasuo Ohgaki
Hi Stas, On Fri, Apr 8, 2016 at 8:36 AM, Stanislav Malyshev wrote: >> Session module does not require hashing to generate session ID. This >> RFC removes hashing from session module and enable use_strict_mode as >> an insurance for broken RNG. >> >> https://wiki.php.net/rfc/session-id-without-has

Re: [PHP-DEV] [RFC][DISCUSSION] Session ID without hashing

2016-04-07 Thread Stanislav Malyshev
Hi! > Session module does not require hashing to generate session ID. This > RFC removes hashing from session module and enable use_strict_mode as > an insurance for broken RNG. > > https://wiki.php.net/rfc/session-id-without-hashing I'm not sure why that should be the default. First of all, I'm

Re: [PHP-DEV] [RFC][DISCUSSION] Session ID without hashing

2016-04-07 Thread Markus Fischer
On 06.04.2016 07:47, Yasuo Ohgaki wrote: > Session module does not require hashing to generate session ID. This > RFC removes hashing from session module and enable use_strict_mode as > an insurance for broken RNG. > > https://wiki.php.net/rfc/session-id-without-hashing I cannot talk about the me

[PHP-DEV] [RFC][DISCUSSION] Session ID without hashing

2016-04-07 Thread Yasuo Ohgaki
Hi all, Session module does not require hashing to generate session ID. This RFC removes hashing from session module and enable use_strict_mode as an insurance for broken RNG. https://wiki.php.net/rfc/session-id-without-hashing Comments are appreciated! Regards, -- Yasuo Ohgaki yohg...@ohgaki.