Re: [PHP-DEV] What do you think CSPRNG in PHP

2022-07-27 Thread Go Kudo
2022年7月28日(木) 1:47 Tim Düsterhus : > Hi > > On 7/16/22 23:33, Tim Düsterhus wrote: > > Personally I likely wouldn't have merged the PR in question for the same > > reasons. But at least in that case glibc is at fault :-) > > For those following along: > > It turns out the glibc "userland" implemen

Re: [PHP-DEV] What do you think CSPRNG in PHP

2022-07-27 Thread Tim Düsterhus
Hi On 7/16/22 23:33, Tim Düsterhus wrote: Personally I likely wouldn't have merged the PR in question for the same reasons. But at least in that case glibc is at fault :-) For those following along: It turns out the glibc "userland" implementation of arc4random() was questionable and was sim

Re: [PHP-DEV] What do you think CSPRNG in PHP

2022-07-25 Thread Tim Düsterhus
Hi On 7/25/22 13:14, Go Kudo wrote: However, I still think the overhead of the getrandom syscall in a Linux environment is significant and should be considered. I disagree. On my Intel(R) Core(TM) i5-2430M with Ubuntu 20.04 with Linux 5.4.0-123-generic I can call random_bytes(16) (128 Bits of

Re: [PHP-DEV] What do you think CSPRNG in PHP

2022-07-25 Thread Sara Golemon
On Mon, Jul 25, 2022 at 7:08 AM Go Kudo wrote: > Indeed, But ext-openssl is not always available. > To use it in a ext-session, etc., it must be bundled reliably. > Which means that users can generally call `random_bytes()/random_int()` for an always available, but maybe not most performant CSPRN

Re: [PHP-DEV] What do you think CSPRNG in PHP

2022-07-25 Thread Christoph M. Becker
On 25.07.2022 at 13:32, Jakub Zelenka wrote: > On Mon, Jul 25, 2022 at 12:14 PM Go Kudo wrote: > >> 2022年7月17日(日) 6:33 Tim Düsterhus : >> >>> On 7/15/22 17:54, Go Kudo wrote: However, there are several challenges to this. - Increased maintenance costs - Requires optimization f

Re: [PHP-DEV] What do you think CSPRNG in PHP

2022-07-25 Thread Go Kudo
2022年7月25日(月) 20:32 Jakub Zelenka : > > > On Mon, Jul 25, 2022 at 12:14 PM Go Kudo wrote: > >> 2022年7月17日(日) 6:33 Tim Düsterhus : >> >> > Hi >> > >> > On 7/15/22 17:54, Go Kudo wrote: >> > > However, there are several challenges to this. >> > > >> > > - Increased maintenance costs >> > > - Requir

Re: [PHP-DEV] What do you think CSPRNG in PHP

2022-07-25 Thread Jakub Zelenka
On Mon, Jul 25, 2022 at 12:14 PM Go Kudo wrote: > 2022年7月17日(日) 6:33 Tim Düsterhus : > > > Hi > > > > On 7/15/22 17:54, Go Kudo wrote: > > > However, there are several challenges to this. > > > > > > - Increased maintenance costs > > > - Requires optimization for CPU architecture > > > - Requires

Re: [PHP-DEV] What do you think CSPRNG in PHP

2022-07-25 Thread Go Kudo
2022年7月17日(日) 6:33 Tim Düsterhus : > Hi > > On 7/15/22 17:54, Go Kudo wrote: > > However, there are several challenges to this. > > > > - Increased maintenance costs > > - Requires optimization for CPU architecture > > - Requires familiarity with CSPRNG > > > > PHP already bundles xxHash and appea

Re: [PHP-DEV] What do you think CSPRNG in PHP

2022-07-16 Thread Tim Düsterhus
Hi On 7/15/22 17:54, Go Kudo wrote: However, there are several challenges to this. - Increased maintenance costs - Requires optimization for CPU architecture - Requires familiarity with CSPRNG PHP already bundles xxHash and appears ready to make this happen. Also, an appropriate CSPRNG implem

[PHP-DEV] What do you think CSPRNG in PHP

2022-07-15 Thread Go Kudo
Hi Internals. Random Extension is accepted and being implemented in PHP 8.2. Many thanks for the review. The changes to enable arc4random in glibc were recently merged. https://github.com/php/php-src/pull/8984 This has the effect of reducing the number of getrandom system calls issued on Linux