Re: [PHP-DEV] What do you think CSPRNG in PHP

2022-07-27 Thread Go Kudo
2022年7月28日(木) 1:47 Tim Düsterhus : > Hi > > On 7/16/22 23:33, Tim Düsterhus wrote: > > Personally I likely wouldn't have merged the PR in question for the same > > reasons. But at least in that case glibc is at fault :-) > > For those following along: > > It turns out the glibc "userland" implemen

Re: [PHP-DEV] What do you think CSPRNG in PHP

2022-07-27 Thread Tim Düsterhus
Hi On 7/16/22 23:33, Tim Düsterhus wrote: Personally I likely wouldn't have merged the PR in question for the same reasons. But at least in that case glibc is at fault :-) For those following along: It turns out the glibc "userland" implementation of arc4random() was questionable and was sim

Re: [PHP-DEV] What do you think CSPRNG in PHP

2022-07-25 Thread Tim Düsterhus
Hi On 7/25/22 13:14, Go Kudo wrote: However, I still think the overhead of the getrandom syscall in a Linux environment is significant and should be considered. I disagree. On my Intel(R) Core(TM) i5-2430M with Ubuntu 20.04 with Linux 5.4.0-123-generic I can call random_bytes(16) (128 Bits of

Re: [PHP-DEV] What do you think CSPRNG in PHP

2022-07-25 Thread Sara Golemon
On Mon, Jul 25, 2022 at 7:08 AM Go Kudo wrote: > Indeed, But ext-openssl is not always available. > To use it in a ext-session, etc., it must be bundled reliably. > Which means that users can generally call `random_bytes()/random_int()` for an always available, but maybe not most performant CSPRN

Re: [PHP-DEV] What do you think CSPRNG in PHP

2022-07-25 Thread Christoph M. Becker
On 25.07.2022 at 13:32, Jakub Zelenka wrote: > On Mon, Jul 25, 2022 at 12:14 PM Go Kudo wrote: > >> 2022年7月17日(日) 6:33 Tim Düsterhus : >> >>> On 7/15/22 17:54, Go Kudo wrote: However, there are several challenges to this. - Increased maintenance costs - Requires optimization f

Re: [PHP-DEV] What do you think CSPRNG in PHP

2022-07-25 Thread Go Kudo
2022年7月25日(月) 20:32 Jakub Zelenka : > > > On Mon, Jul 25, 2022 at 12:14 PM Go Kudo wrote: > >> 2022年7月17日(日) 6:33 Tim Düsterhus : >> >> > Hi >> > >> > On 7/15/22 17:54, Go Kudo wrote: >> > > However, there are several challenges to this. >> > > >> > > - Increased maintenance costs >> > > - Requir

Re: [PHP-DEV] What do you think CSPRNG in PHP

2022-07-25 Thread Jakub Zelenka
On Mon, Jul 25, 2022 at 12:14 PM Go Kudo wrote: > 2022年7月17日(日) 6:33 Tim Düsterhus : > > > Hi > > > > On 7/15/22 17:54, Go Kudo wrote: > > > However, there are several challenges to this. > > > > > > - Increased maintenance costs > > > - Requires optimization for CPU architecture > > > - Requires

Re: [PHP-DEV] What do you think CSPRNG in PHP

2022-07-25 Thread Go Kudo
2022年7月17日(日) 6:33 Tim Düsterhus : > Hi > > On 7/15/22 17:54, Go Kudo wrote: > > However, there are several challenges to this. > > > > - Increased maintenance costs > > - Requires optimization for CPU architecture > > - Requires familiarity with CSPRNG > > > > PHP already bundles xxHash and appea

Re: [PHP-DEV] What do you think CSPRNG in PHP

2022-07-16 Thread Tim Düsterhus
Hi On 7/15/22 17:54, Go Kudo wrote: However, there are several challenges to this. - Increased maintenance costs - Requires optimization for CPU architecture - Requires familiarity with CSPRNG PHP already bundles xxHash and appears ready to make this happen. Also, an appropriate CSPRNG implem