Re: [PHP-DEV] GitHub URL for [PHP-DEV] [RFC] Platform and extension-independent API to the system CSPRNG

2012-01-09 Thread Tom Worster
On 1/9/12 10:39 AM, "Thomas Hruska" wrote: >I'm glad someone is doing something about making more sources of >randomness in PHP. I am pleased to hear it. >Instead of a 'bool', use an 'int' for $is_strong_result but more >accurately call it $result_strength. Assign a minimum recommended >thres

Re: [PHP-DEV] GitHub URL for [PHP-DEV] [RFC] Platform and extension-independent API to the system CSPRNG

2012-01-09 Thread Thomas Hruska
On 1/9/2012 7:50 AM, Tom Worster wrote: Pierre, 1. The proposal in the RFC is explicit: "The function should neither block nor return a failure status in the case that the systems entropy pool is depleted. However, it should allow the caller to discover if this is the case. etc..." 2. The curre

Re: [PHP-DEV] GitHub URL for [PHP-DEV] [RFC] Platform and extension-independent API to the system CSPRNG

2012-01-09 Thread Tom Worster
Pierre, 1. The proposal in the RFC is explicit: "The function should neither block nor return a failure status in the case that the systems entropy pool is depleted. However, it should allow the caller to discover if this is the case. etc..." 2. The current code implements that by setting the $is

Re: [PHP-DEV] GitHub URL for [PHP-DEV] [RFC] Platform and extension-independent API to the system CSPRNG

2012-01-09 Thread Pierre Joye
hi, Some comments, same as I did before: cs means crypto safe. In your implementation, it is by no mean crypto safe as it relies on urandom for the cases where /dev/random did not return enough data (some OS are non blocking here), while linux is. It should detect which entropy sources are avail

Re: [PHP-DEV] GitHub URL for [PHP-DEV] [RFC] Platform and extension-independent API to the system CSPRNG

2012-01-09 Thread Tom Worster
I added it at the top, I hope that's ok. the URL is https://github.com/tom--/php-cs_random_bytes Thanks for pointing that out Tom On 1/9/12 7:54 AM, "Pierre Joye" wrote: >pls add it to the RFC, the right one as this one is a 404. > >On Mon, Jan 9, 2012 at 2:58 AM, Tom Worster wrote: >> I forg

Re: [PHP-DEV] GitHub URL for [PHP-DEV] [RFC] Platform and extension-independent API to the system CSPRNG

2012-01-09 Thread Pierre Joye
pls add it to the RFC, the right one as this one is a 404. On Mon, Jan 9, 2012 at 2:58 AM, Tom Worster wrote: > I forgot the URL: https://github.com/tom--/php-cs_random_bytesemo > > :X > > tom > > On 1/8/12 8:56 PM, "Tom Worster" wrote: > >>I have also set up a github repo with 4 files in it. It

[PHP-DEV] GitHub URL for [PHP-DEV] [RFC] Platform and extension-independent API to the system CSPRNG

2012-01-08 Thread Tom Worster
I forgot the URL: https://github.com/tom--/php-cs_random_bytesemo :X tom On 1/8/12 8:56 PM, "Tom Worster" wrote: >I have also set up a github repo with 4 files in it. It is a first hack >of >a function that does part of what I described in the RFC. It's based on >the interface of openssl_rand

Re: [PHP-DEV] [RFC] Platform and extension-independent API to the system CSPRNG

2012-01-08 Thread Tom Worster
I have also set up a github repo with 4 files in it. It is a first hack of a function that does part of what I described in the RFC. It's based on the interface of openssl_random_pseudo_bytes() and the guts of mcrypt_create_iv(). It is provisionally named cs_random_bytes(). For now it builds and w

Re: [PHP-DEV] [RFC] Platform and extension-independent API to the system CSPRNG

2012-01-08 Thread Ferenc Kovacs
On Mon, Jan 9, 2012 at 1:42 AM, Tom Worster wrote: > Hi, > > I added the new RFC https://wiki.php.net/rfc/csrandombytes which is in its > first draft. > > > I attempted to be fair with respect to the discussion that has already > taken place here. > > How does this get listed on the https://wiki.

[PHP-DEV] [RFC] Platform and extension-independent API to the system CSPRNG

2012-01-08 Thread Tom Worster
Hi, I added the new RFC https://wiki.php.net/rfc/csrandombytes which is in its first draft. I attempted to be fair with respect to the discussion that has already taken place here. How does this get listed on the https://wiki.php.net/rfc page? Tom -- PHP Internals - PHP Runtime Development