PHP :: Doc Bug #81384 :: Secureness of GMP random functions undocumented

Secureness of GMP random functions undocumented

Submitted:

2021-08-26 09:12 UTC

Modified:

2021-08-26 10:33 UTC

Votes:	1
Avg. Score:	1.0 ± 0.0
Reproduced:	1 of 1 (100.0%)
Same Version:	1 (100.0%)
Same OS:	1 (100.0%)

From:

michelbach94 at gmail dot com

Assigned:

Status:

Verified

Package:

GNU MP related

PHP Version:

8.0.9

OS:

any

Private report:

CVE-ID:

None

View Developer Edit

Welcome! If you don't have a Git account, you can't do anything here.
If you reported this bug, you can edit this bug over here.

php.net Username: php.net Password:

Quick Fix:	(description)
	Block user comment
Status:		Assign to:
Package:
Bug Type:
Summary:
From:	michelbach94 at gmail dot com
New email:
PHP Version:		OS:

New/Additional Comment:

[2021-08-26 09:12 UTC] michelbach94 at gmail dot com

Description:
------------
Usually, the documentation of PHP functions that return randomness says whether the respective function is cryptographically secure. However, this is not the case with the GMP randomness functions gmp_random_bits() and gmp_random_range() (nor with the deprecated gmp_random()).

From a Google search, I found that these functions are not cryptographically secure sources of randomness (https://stackoverflow.com/a/56377850). This should be added to the documentation as PHP's GMP implementation being able to handle large numbers is very welcoming to the implementation of cryptographic primitives.

Patches

Pull Requests

History

AllCommentsChangesGit/SVN commitsRelated reports

[2021-08-26 10:33 UTC] cmb@php.net

-Status: Open +Status: Verified

[2021-08-26 10:33 UTC] cmb@php.net

gmp_random_bits(), gmp_random() and gmp_random_range() call
mpz_urandomb() and mpz_urandomm(), respectively, internally, and
these names suggest that urandom is used as source of randomness,
but this is not explicitly documented[1], so possibly that "u"
just refers to the uniform distribution.

So, yes, if in doubt don't use these numbers for cryptographic
purposes.

[1] <https://gmplib.org/manual/Integer-Random-Numbers>

[2023-05-02 18:33 UTC] sethhawks14 at aol dot com

(https://collegegrazing.com/)github.com
(https://collegegrazing.com/blog/)github.com
(https://collegegrazing.com/affiliate-disclosure/)github.com
(https://collegegrazing.com/terms-of-use/)github.com
(https://collegegrazing.com/fake-id/best-fake-id-websites/)github.com
(https://collegegrazing.com/about/)github.com
(https://collegegrazing.com/contact/)github.com
(https://collegegrazing.com/fake-id/)github.com
(https://collegegrazing.com/fake-id/buy-fake-ids/)github.com
(https://collegegrazing.com/how-to-get-a-fake-id/)github.com
(https://collegegrazing.com/top-fake-id-review/)github.com
(https://collegegrazing.com/fake-id/buy-virginia-fake-id/)github.com
(https://collegegrazing.com/fake-id/buy-new-mexico-fake-id/)github.com
(https://collegegrazing.com/fake-id/buy-kentucky-fake-id/)github.com
(https://collegegrazing.com/fake-id/buy-iowa-fake-id/)github.com
(https://collegegrazing.com/fake-id/buy-maine-fake-id/)github.com
(https://collegegrazing.com/all-state-fakes-review/)github.com
(https://collegegrazing.com/fake-id/buy-colorado-fake-id/)github.com
(https://collegegrazing.com/fake-id/buy-missouri-fake-id/)github.com
(https://collegegrazing.com/fake-id/buy-new-hampshire-fake-id/)github.com
(https://collegegrazing.com/fake-id/buy-vermont-fake-id/)github.com
(https://collegegrazing.com/fake-id/buy-georgia-fake-id/)github.com
(https://collegegrazing.com/fake-id/buy-arizona-fake-id/)github.com
(https://collegegrazing.com/fake-id/buy-alabama-fake-id/)github.com
(https://collegegrazing.com/fake-id/buy-florida-fake-id/)github.com
(https://collegegrazing.com/fake-id/buy-maryland-fake-id/)github.com
(https://collegegrazing.com/fake-id/buy-wyoming-fake-id/)github.com
(https://collegegrazing.com/fake-id/what-happens-if-i-get-caught/)github.com
(https://collegegrazing.com/fake-id/buy-california-fake-id/)github.com
(https://collegegrazing.com/fake-id/buy-new-york-fake-id/)github.com
(https://collegegrazing.com/fake-id/buy-alaska-fake-id/)github.com
(https://collegegrazing.com/fake-id/buy-rhode-island-fake-id/)github.com
(https://collegegrazing.com/magic-fake-id-review/)github.com
(https://collegegrazing.com/fake-id/buy-utah-fake-id/)github.com
(https://collegegrazing.com/fake-id/buy-hawaii-fake-id/)github.com
(https://collegegrazing.com/fake-id/buy-minnesota-fake-id/)github.com
(https://collegegrazing.com/fake-id/buy-oklahoma-fake-id/)github.com
(https://collegegrazing.com/fake-id/buy-illinois-fake-id/)github.com
(https://collegegrazing.com/evolved-ids-review/)github.com
(https://collegegrazing.com/fake-id/buy-indiana-fake-id/)github.com
(https://collegegrazing.com/fake-id/buy-montana-fake-id/)github.com
(https://collegegrazing.com/how-do-bouncers-spot-fake-ids/)github.com
(https://collegegrazing.com/fake-id/common-uses/)github.com
(https://collegegrazing.com/fake-id/buy-arkansas-fake-id/)github.com
(https://collegegrazing.com/fake-id/buy-pennsylvania-fake-id/)github.com
(https://collegegrazing.com/blog/page/2/)github.com
(https://collegegrazing.com/fake-id/buy-new-jersey-fake-id/)github.com
(https://collegegrazing.com/how-to-spot-a-georgia-fake-id/)github.com
(https://collegegrazing.com/scannable-fake-ids/)github.com
(https://collegegrazing.com/fake-id/buy-south-dakota-fake-id/)github.com
(https://collegegrazing.com/fake-id/buy-massachusetts-fake-id/)github.com)github.com
(https://collegegrazing.com/fake-id/how-to-spot/)github.com
(https://collegegrazing.com/fake-id/buy-west-virginia-fake-id/)github.com
(https://collegegrazing.com/fake-id/buy-connecticut-fake-id/)github.com
(https://collegegrazing.com/fake-id/buy-wisconsin-fake-id/)github.com
(https://collegegrazing.com/fake-id/buy-idaho-fake-id/)github.com
(https://collegegrazing.com/fake-id/buy-columbia-fake-id/)github.com
(https://collegegrazing.com/fake-id/how-to-make/)github.com
(https://collegegrazing.com/fake-id/buy-mississippi-fake-id/)github.com
(https://collegegrazing.com/fake-id/buy-nevada-fake-id/)github.com
(https://collegegrazing.com/how-to-pay-for-fake-id/)github.com
(https://collegegrazing.com/how-to-take-a-fake-id-photo-at-home/)github.com
(https://collegegrazing.com/fake-id/buy-oregon-fake-id/)github.com
(https://collegegrazing.com/fake-id/buy-texas-fake-id/)github.com
(https://collegegrazing.com/fake-id/buy-north-dakota-fake-id/)github.com
(https://collegegrazing.com/fake-id/buy-louisiana-fake-id/)github.com
(https://collegegrazing.com/fake-id/buy-south-carolina-fake-id/)github.com
(https://collegegrazing.com/fake-id/buy-kansas-fake-id/)github.com
(https://collegegrazing.com/fake-id/buy-tennessee-fake-id/)github.com
(https://collegegrazing.com/fake-id/types-of-fake-ids/)github.com
(https://collegegrazing.com/fake-id/buy-delaware-fake-id/)github.com
(https://collegegrazing.com/lost-identification-review/)github.com
(https://collegegrazing.com/fake-id/buy-washington-fake-id/)github.com
(https://collegegrazing.com/fake-id/buy-nebraska-fake-id/)github.com
(https://collegegrazing.com/dingo-fakes-review/)github.com
(https://collegegrazing.com/fake-id/buy-north-carolina-fake-id/)github.com
(https://collegegrazing.com/fake-id/buy-michigan-fake-id/)github.com
(https://collegegrazing.com/fake-id/buy-ohio-fake-id/)github.com
(https://collegegrazing.com/fake-id/best-states/)github.com
(https://collegegrazing.com/idviking-review/)github.com
(https://collegegrazing.com/super-printer-bros-review/)github.com
(https://collegegrazing.com/idgod-review/)github.com
(https://collegegrazing.com/bogus-braxtor-review/)github.com
(https://collegegrazing.com/newids-review/)github.com
(https://collegegrazing.com/litfakes-review/)github.com
(https://collegegrazing.com/old-ironside-fakes-review/)github.com
(https://collegegrazing.com/idhurry-review/)github.com

	php.net \| support \| documentation \| report a bug \| advanced search \| search howto \| statistics \| random bug \| login
go to bug id or search bugs for


Copyright © 2001-2024 The PHP Group All rights reserved.	Last updated: Thu Nov 21 13:01:29 2024 UTC