{"action":"created","issue":{"url":"https://api.github.com/repos/paragonie/random_compat/issues/5","labels_url":"https://api.github.com/repos/paragonie/random_compat/issues/5/labels{/name}","comments_url":"https://api.github.com/repos/paragonie/random_compat/issues/5/comments","events_url":"https://api.github.com/repos/paragonie/random_compat/issues/5/events","html_url":"https://github.com/paragonie/random_compat/issues/5","id":93659995,"number":5,"title":"openssl_random_pseudo_bytes() does not appear to cryptographically secure","user":{"login":"MasonM","id":651224,"avatar_url":"https://avatars.githubusercontent.com/u/651224?v=3","gravatar_id":"","url":"https://api.github.com/users/MasonM","html_url":"https://github.com/MasonM","followers_url":"https://api.github.com/users/MasonM/followers","following_url":"https://api.github.com/users/MasonM/following{/other_user}","gists_url":"https://api.github.com/users/MasonM/gists{/gist_id}","starred_url":"https://api.github.com/users/MasonM/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/MasonM/subscriptions","organizations_url":"https://api.github.com/users/MasonM/orgs","repos_url":"https://api.github.com/users/MasonM/repos","events_url":"https://api.github.com/users/MasonM/events{/privacy}","received_events_url":"https://api.github.com/users/MasonM/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":19,"created_at":"2015-07-08T00:28:42Z","updated_at":"2015-10-14T13:53:21Z","closed_at":"2015-10-13T21:41:31Z","body":"Although the PHP docs claim that openssl_random_pseudo_bytes() returns a \"cryptographically strong\" result as long as the `$crypto_strong` parameter is true, I checked the source and that does not appear to be the case. [The openssl_random_pseudo_bytes() PHP function calls the RAND_psuedo_bytes() OpenSSL function](https://github.com/php/php-src/blob/php-5.6.10/ext/openssl/openssl.c#L5408), which [the OpenSSL docs say](https://www.openssl.org/docs/crypto/RAND_bytes.html) should only be used for non-cryptographic purposes:\r\n\r\n> RAND_pseudo_bytes() has been deprecated. Users should use RAND_bytes() instead. RAND_pseudo_bytes() puts num pseudo-random bytes into buf. Pseudo-random byte sequences generated by RAND_pseudo_bytes() will be unique if they are of sufficient length, but are not necessarily unpredictable. They can be used for non-cryptographic purposes and for certain purposes in cryptographic protocols, but usually not for key generation etc.\r\n\r\nIt's quite possible I'm missing something here. If so, I apologize for wasting your time."},"comment":{"url":"https://api.github.com/repos/paragonie/random_compat/issues/comments/148056109","html_url":"https://github.com/paragonie/random_compat/issues/5#issuecomment-148056109","issue_url":"https://api.github.com/repos/paragonie/random_compat/issues/5","id":148056109,"user":{"login":"tom--","id":1178722,"avatar_url":"https://avatars.githubusercontent.com/u/1178722?v=3","gravatar_id":"","url":"https://api.github.com/users/tom--","html_url":"https://github.com/tom--","followers_url":"https://api.github.com/users/tom--/followers","following_url":"https://api.github.com/users/tom--/following{/other_user}","gists_url":"https://api.github.com/users/tom--/gists{/gist_id}","starred_url":"https://api.github.com/users/tom--/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/tom--/subscriptions","organizations_url":"https://api.github.com/users/tom--/orgs","repos_url":"https://api.github.com/users/tom--/repos","events_url":"https://api.github.com/users/tom--/events{/privacy}","received_events_url":"https://api.github.com/users/tom--/received_events","type":"User","site_admin":false},"created_at":"2015-10-14T13:53:21Z","updated_at":"2015-10-14T13:53:21Z","body":"I agree completely with your analysis but not the conclusion. I think putting OpenSSL behind the `random_bytes()` API, which provides randomness \"[for use within cryptographic contexts](https://secure.php.net/manual/en/intro.csprng.php)\", is ethically dubious and a wasted opportunity to educate users about their crippled PHP and what to do about it.\r\n\r\nI say it is ethically dubious for two reasons. First there is the general feeling of mistrust towards OpenSSL I get from the various footguns its API provides and the history of injuries to feet that have been documented, at least one of which is referenced above. Evidently I'm not alone in having this concern.\r\n\r\nBut more importantly, under the conditions you set out in those three bullets, the only conditions in which random_compat uses OpenSSL, there is cause to ask if its RNG is properly seeded. But random_compat has no way to answer that at runtime. The history of randomness failures in cryptography demonstrates the importance and sensitivity of RNG seeding. Hence I believe that if there's any doubt over an RNG's seeding then is not OK to say it is suitable for use within cryptographic contexts.\r\n\r\nThe wasted opportunity is simply that random_compat could alert the user whose PHP system is not suitable for general cryptography when she tries out the package. The exception's documentation would educate the user on the nature of the problem and the options to solve it. One option might be a way to quiet the exception and use OpenSSL, a decision an *educated* user might reasonably make but not one random_compat can make in good conscience *a priori*.\r\n"}}