php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login

go to bug id or search bugs for

Doc Bug #81384 Secureness of GMP random functions undocumented
Submitted: 2021-08-26 09:12 UTC Modified: 2021-08-26 10:33 UTC
Votes:1
Avg. Score:1.0 ± 0.0
Reproduced:1 of 1 (100.0%)
Same Version:1 (100.0%)
Same OS:1 (100.0%)
From: michelbach94 at gmail dot com Assigned:
Status: Verified Package: GNU MP related
PHP Version: 8.0.9 OS: any
Private report: No CVE-ID: None
View Developer Edit
 [2021-08-26 09:12 UTC] michelbach94 at gmail dot com 
Description:
------------
Usually, the documentation of PHP functions that return randomness says whether the respective function is cryptographically secure. However, this is not the case with the GMP randomness functions gmp_random_bits() and gmp_random_range() (nor with the deprecated gmp_random()).

From a Google search, I found that these functions are not cryptographically secure sources of randomness (https://stackoverflow.com/a/56377850). This should be added to the documentation as PHP's GMP implementation being able to handle large numbers is very welcoming to the implementation of cryptographic primitives.

Patches

Pull Requests

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2021-08-26 10:33 UTC] cmb@php.net
-Status: Open +Status: Verified
 [2021-08-26 10:33 UTC] cmb@php.net 
gmp_random_bits(), gmp_random() and gmp_random_range() call
mpz_urandomb() and mpz_urandomm(), respectively, internally, and
these names suggest that urandom is used as source of randomness,
but this is not explicitly documented[1], so possibly that "u"
just refers to the uniform distribution.

So, yes, if in doubt don't use these numbers for cryptographic
purposes.

[1] <https://gmplib.org/manual/Integer-Random-Numbers>
 [2023-05-02 18:33 UTC] sethhawks14 at aol dot com 
(https://collegegrazing.com/)github.com
(https://collegegrazing.com/blog/)github.com
(https://collegegrazing.com/affiliate-disclosure/)github.com
(https://collegegrazing.com/terms-of-use/)github.com
(https://collegegrazing.com/fake-id/best-fake-id-websites/)github.com
(https://collegegrazing.com/about/)github.com
(https://collegegrazing.com/contact/)github.com
(https://collegegrazing.com/fake-id/)github.com
(https://collegegrazing.com/fake-id/buy-fake-ids/)github.com
(https://collegegrazing.com/how-to-get-a-fake-id/)github.com
(https://collegegrazing.com/top-fake-id-review/)github.com
(https://collegegrazing.com/fake-id/buy-virginia-fake-id/)github.com
(https://collegegrazing.com/fake-id/buy-new-mexico-fake-id/)github.com
(https://collegegrazing.com/fake-id/buy-kentucky-fake-id/)github.com
(https://collegegrazing.com/fake-id/buy-iowa-fake-id/)github.com
(https://collegegrazing.com/fake-id/buy-maine-fake-id/)github.com
(https://collegegrazing.com/all-state-fakes-review/)github.com
(https://collegegrazing.com/fake-id/buy-colorado-fake-id/)github.com
(https://collegegrazing.com/fake-id/buy-missouri-fake-id/)github.com
(https://collegegrazing.com/fake-id/buy-new-hampshire-fake-id/)github.com
(https://collegegrazing.com/fake-id/buy-vermont-fake-id/)github.com
(https://collegegrazing.com/fake-id/buy-georgia-fake-id/)github.com
(https://collegegrazing.com/fake-id/buy-arizona-fake-id/)github.com
(https://collegegrazing.com/fake-id/buy-alabama-fake-id/)github.com
(https://collegegrazing.com/fake-id/buy-florida-fake-id/)github.com
(https://collegegrazing.com/fake-id/buy-maryland-fake-id/)github.com
(https://collegegrazing.com/fake-id/buy-wyoming-fake-id/)github.com
(https://collegegrazing.com/fake-id/what-happens-if-i-get-caught/)github.com
(https://collegegrazing.com/fake-id/buy-california-fake-id/)github.com
(https://collegegrazing.com/fake-id/buy-new-york-fake-id/)github.com
(https://collegegrazing.com/fake-id/buy-alaska-fake-id/)github.com
(https://collegegrazing.com/fake-id/buy-rhode-island-fake-id/)github.com
(https://collegegrazing.com/magic-fake-id-review/)github.com
(https://collegegrazing.com/fake-id/buy-utah-fake-id/)github.com
(https://collegegrazing.com/fake-id/buy-hawaii-fake-id/)github.com
(https://collegegrazing.com/fake-id/buy-minnesota-fake-id/)github.com
(https://collegegrazing.com/fake-id/buy-oklahoma-fake-id/)github.com
(https://collegegrazing.com/fake-id/buy-illinois-fake-id/)github.com
(https://collegegrazing.com/evolved-ids-review/)github.com
(https://collegegrazing.com/fake-id/buy-indiana-fake-id/)github.com
(https://collegegrazing.com/fake-id/buy-montana-fake-id/)github.com
(https://collegegrazing.com/how-do-bouncers-spot-fake-ids/)github.com
(https://collegegrazing.com/fake-id/common-uses/)github.com
(https://collegegrazing.com/fake-id/buy-arkansas-fake-id/)github.com
(https://collegegrazing.com/fake-id/buy-pennsylvania-fake-id/)github.com
(https://collegegrazing.com/blog/page/2/)github.com
(https://collegegrazing.com/fake-id/buy-new-jersey-fake-id/)github.com
(https://collegegrazing.com/how-to-spot-a-georgia-fake-id/)github.com
(https://collegegrazing.com/scannable-fake-ids/)github.com
(https://collegegrazing.com/fake-id/buy-south-dakota-fake-id/)github.com
(https://collegegrazing.com/fake-id/buy-massachusetts-fake-id/)github.com)github.com
(https://collegegrazing.com/fake-id/how-to-spot/)github.com
(https://collegegrazing.com/fake-id/buy-west-virginia-fake-id/)github.com
(https://collegegrazing.com/fake-id/buy-connecticut-fake-id/)github.com
(https://collegegrazing.com/fake-id/buy-wisconsin-fake-id/)github.com
(https://collegegrazing.com/fake-id/buy-idaho-fake-id/)github.com
(https://collegegrazing.com/fake-id/buy-columbia-fake-id/)github.com
(https://collegegrazing.com/fake-id/how-to-make/)github.com
(https://collegegrazing.com/fake-id/buy-mississippi-fake-id/)github.com
(https://collegegrazing.com/fake-id/buy-nevada-fake-id/)github.com
(https://collegegrazing.com/how-to-pay-for-fake-id/)github.com
(https://collegegrazing.com/how-to-take-a-fake-id-photo-at-home/)github.com
(https://collegegrazing.com/fake-id/buy-oregon-fake-id/)github.com
(https://collegegrazing.com/fake-id/buy-texas-fake-id/)github.com
(https://collegegrazing.com/fake-id/buy-north-dakota-fake-id/)github.com
(https://collegegrazing.com/fake-id/buy-louisiana-fake-id/)github.com
(https://collegegrazing.com/fake-id/buy-south-carolina-fake-id/)github.com
(https://collegegrazing.com/fake-id/buy-kansas-fake-id/)github.com
(https://collegegrazing.com/fake-id/buy-tennessee-fake-id/)github.com
(https://collegegrazing.com/fake-id/types-of-fake-ids/)github.com
(https://collegegrazing.com/fake-id/buy-delaware-fake-id/)github.com
(https://collegegrazing.com/lost-identification-review/)github.com
(https://collegegrazing.com/fake-id/buy-washington-fake-id/)github.com
(https://collegegrazing.com/fake-id/buy-nebraska-fake-id/)github.com
(https://collegegrazing.com/dingo-fakes-review/)github.com
(https://collegegrazing.com/fake-id/buy-north-carolina-fake-id/)github.com
(https://collegegrazing.com/fake-id/buy-michigan-fake-id/)github.com
(https://collegegrazing.com/fake-id/buy-ohio-fake-id/)github.com
(https://collegegrazing.com/fake-id/best-states/)github.com
(https://collegegrazing.com/idviking-review/)github.com
(https://collegegrazing.com/super-printer-bros-review/)github.com
(https://collegegrazing.com/idgod-review/)github.com
(https://collegegrazing.com/bogus-braxtor-review/)github.com
(https://collegegrazing.com/newids-review/)github.com
(https://collegegrazing.com/litfakes-review/)github.com
(https://collegegrazing.com/old-ironside-fakes-review/)github.com
(https://collegegrazing.com/idhurry-review/)github.com
 
PHP Copyright © 2001-2024 The PHP Group
All rights reserved. 		Last updated: Thu Oct 31 22:01:27 2024 UTC