I've been trying to catch up on the plans in PHP 7 for changes in security features and APIs and I got confused. Questions on my mind at the moment include:
1. Will there be a portable API for getting random bytes from the platform's CSPRNG? https://wiki.php.net/ideas/php6 lists as an addition: "Reliable, userfriendly RNG APIs: Provide a userfriendly and reliable RNG APIs, available by default, on all supported platforms and for all usages (from weak to crypto safe)." 2. What's going to happen to mcrypt? I see the vote to excise it did not pass. Does this mean that (i.e. imply that) PHP's plan is to keep a security lib that hasn't been maintained for 8 years for the next 5+ years? 3. Will the OpenSSL ext remain as it currently stands? There have been a few discussions about this but I'm not clear if any decisions have been made about changing it or providing a new API. 4. What does openssl_random_pseudo_bytes() really do in PHP? Where does it get random bytes from in the various different platforms? Is it going to change in PHP 7? 5. Is the weird Linux /dev/random[1] still supported? If so, is used by default in any PHP API? 6. I noticed some work on constant-time functions. Is this for security purposes, i.e. defeating remote timing attacks? Is there an RFC? "Feature Freeze" for PHP 7 is coming soon. I, for one, would value a summary of what's happening in PHP 7 with respect to security topics like but not limited to these. Some kinda of document detailing the plan, if there is one, would be real swell. Tom --- [1] http://sockpuppet.org/blog/2014/02/25/safely-generate-random-numbers/ -- PHP Internals - PHP Runtime Development Mailing List To unsubscribe, visit: http://www.php.net/unsub.php
