[RFC] RNG fixes #1986
[RFC] RNG fixes #1986
Conversation
|
To clarify: Does the MT compatibility mode work if you specify a range? I would expect you'd still get a different sequence because the scaling is done differently. (Though I personally recommend not listening to the single loud person who wants a compatibility mode.) Btw, we already have a bitset implementation in zend_bitset.h. |
|
The mode takes effect from the next If you're not using And yes: Will produce different output to: Did you mean does ranged output produce different from pre 7.1 even in compatibility mode? Yes, it does. (fixing RAND_RANGE is a distinct option from fixing mt_rand) |
| PHP_MD5_CTX md5ctx; | ||
| unsigned char hash[16]; | ||
|
|
||
| php_random_bytes_throw(&nonce, sizeof(nonce)); | ||
| nonce &= 0x7fffffff; |
There was a problem hiding this comment.
this suggests that sizeof(nonce) is guaranteed to be 4. the previous suggests that it is not
There was a problem hiding this comment.
php_rand() would have originally returned up to 2 ** 31
The nonce variable may be 32 or 64 bit, but I'm limiting it to the same range of values it previously had.
|
Since the only users who need the compat sequence are using a seed, why not hide the mode selector in that function? Otherwise the 7.1 migration guide will document I know the vote already started but... |
|
This feels a lot saner than my knee-jerk addition to appease some camps. The vote is on the concept right. The concept is to provide access to the legacy RNG. The implementation can vary slightly in my opinion. I think we can get away with changing this detail regardless of the vote, because it is wholly better than the additional function. |
The mode of operation is intrinsically linked to seeding, so this makes a lot of sense
| # n' = a + n(b-a+1)/(M+1) | ||
| * | ||
| * -RL | ||
| */ |
There was a problem hiding this comment.
This comment no longer applies, right?
* rng-fixes: Fix legacy mode RAND_RANGE and 32/64-bit consistency Fix crypt salt not being converted to b64 Make mode selection part of mt_srand() Use zend_bitset Improve array_rand distribution Fix some insecure usages of php_rand Alias rand to mt_rand Fix RAND_RANGE for mt_rand Fix mt_rand impl. Provide legacy impl. access. Split rand and mt_rand into separate files
|
Statistical tests of https://gist.github.com/tom--/7311a6fb3bfd00a9f527bb80ac27d668 |
This implements all proposed changes. Some may need to be reverted depending on vote results.
https://wiki.php.net/rfc/rng_fixes