Page MenuHomeDevCentral

Use cryptographically secure pseudo-random integers
ClosedPublic

Authored by dereckson on Apr 9 2022, 12:04.
Tags
None
Referenced Files
F56070093: D2656.id6716.diff
Mon, Nov 2, 13:43
F56070091: D2656.id.diff
Mon, Nov 2, 13:43
F56070079: D2656.id6715.diff
Mon, Nov 2, 13:42
F55954616: D2656.id.diff
Sun, Nov 1, 18:16
F55895422: D2656.id.diff
Sun, Nov 1, 08:58
Unknown Object (File)
Sat, Oct 31, 23:34
Unknown Object (File)
Sat, Oct 31, 23:31
Unknown Object (File)
Fri, Oct 30, 18:14
Subscribers
None

Details

Summary

Methods from Identifiers\Random were currently implemented using
the Mersenne Twister general-purpose pseudorandom number generator.

As randomness is often used as a source to generate credentials,
and to also offer unbiaised results for games, this changes switch
to the CSPRNG method random_int. The random_bytes method was already used.

According PHP manual, the "cryptographically secure pseudo-random number
generator (CSPRNG) API provides an easy and reliable way to generate
crypto-strong random integers and bytes for use within cryptographic contexts."

As our library is PHP 7+ (actually PHP 8.1+), the CSPRNG methods are always
available.

Test Plan

Run unit tests, no regression detected.

Diff Detail

Repository
rKERUALD Keruald libraries development repository
Lint
Lint Not Applicable
Unit
Tests Not Applicable