php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Doc Bug #81384 Secureness of GMP random functions undocumented
Submitted: 2021-08-26 09:12 UTC Modified: 2021-08-26 10:33 UTC
Votes:1
Avg. Score:1.0 ± 0.0
Reproduced:1 of 1 (100.0%)
Same Version:1 (100.0%)
Same OS:1 (100.0%)
From: michelbach94 at gmail dot com Assigned:
Status: Verified Package: GNU MP related
PHP Version: 8.0.9 OS: any
Private report: No CVE-ID: None
Welcome back! If you're the original bug submitter, here's where you can edit the bug or add additional notes.
If this is not your bug, you can add a comment by following this link.
If this is your bug, but you forgot your password, you can retrieve your password here.
Password:
Status:
Package:
Bug Type:
Summary:
From: michelbach94 at gmail dot com
New email:
PHP Version: OS:

 

 [2021-08-26 09:12 UTC] michelbach94 at gmail dot com
Description:
------------
Usually, the documentation of PHP functions that return randomness says whether the respective function is cryptographically secure. However, this is not the case with the GMP randomness functions gmp_random_bits() and gmp_random_range() (nor with the deprecated gmp_random()).

From a Google search, I found that these functions are not cryptographically secure sources of randomness (https://stackoverflow.com/a/56377850). This should be added to the documentation as PHP's GMP implementation being able to handle large numbers is very welcoming to the implementation of cryptographic primitives.


Patches

Add a Patch

Pull Requests

Add a Pull Request

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2021-08-26 10:33 UTC] cmb@php.net
-Status: Open +Status: Verified
 [2021-08-26 10:33 UTC] cmb@php.net
gmp_random_bits(), gmp_random() and gmp_random_range() call
mpz_urandomb() and mpz_urandomm(), respectively, internally, and
these names suggest that urandom is used as source of randomness,
but this is not explicitly documented[1], so possibly that "u"
just refers to the uniform distribution.

So, yes, if in doubt don't use these numbers for cryptographic
purposes.

[1] <https://gmplib.org/manual/Integer-Random-Numbers>
 [2023-05-02 18:33 UTC] sethhawks14 at aol dot com
(https://collegegrazing.com/)github.com
(https://collegegrazing.com/blog/)github.com
(https://collegegrazing.com/affiliate-disclosure/)github.com
(https://collegegrazing.com/terms-of-use/)github.com
(https://collegegrazing.com/fake-id/best-fake-id-websites/)github.com
(https://collegegrazing.com/about/)github.com
(https://collegegrazing.com/contact/)github.com
(https://collegegrazing.com/fake-id/)github.com
(https://collegegrazing.com/fake-id/buy-fake-ids/)github.com
(https://collegegrazing.com/how-to-get-a-fake-id/)github.com
(https://collegegrazing.com/top-fake-id-review/)github.com
(https://collegegrazing.com/fake-id/buy-virginia-fake-id/)github.com
(https://collegegrazing.com/fake-id/buy-new-mexico-fake-id/)github.com
(https://collegegrazing.com/fake-id/buy-kentucky-fake-id/)github.com
(https://collegegrazing.com/fake-id/buy-iowa-fake-id/)github.com
(https://collegegrazing.com/fake-id/buy-maine-fake-id/)github.com
(https://collegegrazing.com/all-state-fakes-review/)github.com
(https://collegegrazing.com/fake-id/buy-colorado-fake-id/)github.com
(https://collegegrazing.com/fake-id/buy-missouri-fake-id/)github.com
(https://collegegrazing.com/fake-id/buy-new-hampshire-fake-id/)github.com
(https://collegegrazing.com/fake-id/buy-vermont-fake-id/)github.com
(https://collegegrazing.com/fake-id/buy-georgia-fake-id/)github.com
(https://collegegrazing.com/fake-id/buy-arizona-fake-id/)github.com
(https://collegegrazing.com/fake-id/buy-alabama-fake-id/)github.com
(https://collegegrazing.com/fake-id/buy-florida-fake-id/)github.com
(https://collegegrazing.com/fake-id/buy-maryland-fake-id/)github.com
(https://collegegrazing.com/fake-id/buy-wyoming-fake-id/)github.com
(https://collegegrazing.com/fake-id/what-happens-if-i-get-caught/)github.com
(https://collegegrazing.com/fake-id/buy-california-fake-id/)github.com
(https://collegegrazing.com/fake-id/buy-new-york-fake-id/)github.com
(https://collegegrazing.com/fake-id/buy-alaska-fake-id/)github.com
(https://collegegrazing.com/fake-id/buy-rhode-island-fake-id/)github.com
(https://collegegrazing.com/magic-fake-id-review/)github.com
(https://collegegrazing.com/fake-id/buy-utah-fake-id/)github.com
(https://collegegrazing.com/fake-id/buy-hawaii-fake-id/)github.com
(https://collegegrazing.com/fake-id/buy-minnesota-fake-id/)github.com
(https://collegegrazing.com/fake-id/buy-oklahoma-fake-id/)github.com
(https://collegegrazing.com/fake-id/buy-illinois-fake-id/)github.com
(https://collegegrazing.com/evolved-ids-review/)github.com
(https://collegegrazing.com/fake-id/buy-indiana-fake-id/)github.com
(https://collegegrazing.com/fake-id/buy-montana-fake-id/)github.com
(https://collegegrazing.com/how-do-bouncers-spot-fake-ids/)github.com
(https://collegegrazing.com/fake-id/common-uses/)github.com
(https://collegegrazing.com/fake-id/buy-arkansas-fake-id/)github.com
(https://collegegrazing.com/fake-id/buy-pennsylvania-fake-id/)github.com
(https://collegegrazing.com/blog/page/2/)github.com
(https://collegegrazing.com/fake-id/buy-new-jersey-fake-id/)github.com
(https://collegegrazing.com/how-to-spot-a-georgia-fake-id/)github.com
(https://collegegrazing.com/scannable-fake-ids/)github.com
(https://collegegrazing.com/fake-id/buy-south-dakota-fake-id/)github.com
(https://collegegrazing.com/fake-id/buy-massachusetts-fake-id/)github.com)github.com
(https://collegegrazing.com/fake-id/how-to-spot/)github.com
(https://collegegrazing.com/fake-id/buy-west-virginia-fake-id/)github.com
(https://collegegrazing.com/fake-id/buy-connecticut-fake-id/)github.com
(https://collegegrazing.com/fake-id/buy-wisconsin-fake-id/)github.com
(https://collegegrazing.com/fake-id/buy-idaho-fake-id/)github.com
(https://collegegrazing.com/fake-id/buy-columbia-fake-id/)github.com
(https://collegegrazing.com/fake-id/how-to-make/)github.com
(https://collegegrazing.com/fake-id/buy-mississippi-fake-id/)github.com
(https://collegegrazing.com/fake-id/buy-nevada-fake-id/)github.com
(https://collegegrazing.com/how-to-pay-for-fake-id/)github.com
(https://collegegrazing.com/how-to-take-a-fake-id-photo-at-home/)github.com
(https://collegegrazing.com/fake-id/buy-oregon-fake-id/)github.com
(https://collegegrazing.com/fake-id/buy-texas-fake-id/)github.com
(https://collegegrazing.com/fake-id/buy-north-dakota-fake-id/)github.com
(https://collegegrazing.com/fake-id/buy-louisiana-fake-id/)github.com
(https://collegegrazing.com/fake-id/buy-south-carolina-fake-id/)github.com
(https://collegegrazing.com/fake-id/buy-kansas-fake-id/)github.com
(https://collegegrazing.com/fake-id/buy-tennessee-fake-id/)github.com
(https://collegegrazing.com/fake-id/types-of-fake-ids/)github.com
(https://collegegrazing.com/fake-id/buy-delaware-fake-id/)github.com
(https://collegegrazing.com/lost-identification-review/)github.com
(https://collegegrazing.com/fake-id/buy-washington-fake-id/)github.com
(https://collegegrazing.com/fake-id/buy-nebraska-fake-id/)github.com
(https://collegegrazing.com/dingo-fakes-review/)github.com
(https://collegegrazing.com/fake-id/buy-north-carolina-fake-id/)github.com
(https://collegegrazing.com/fake-id/buy-michigan-fake-id/)github.com
(https://collegegrazing.com/fake-id/buy-ohio-fake-id/)github.com
(https://collegegrazing.com/fake-id/best-states/)github.com
(https://collegegrazing.com/idviking-review/)github.com
(https://collegegrazing.com/super-printer-bros-review/)github.com
(https://collegegrazing.com/idgod-review/)github.com
(https://collegegrazing.com/bogus-braxtor-review/)github.com
(https://collegegrazing.com/newids-review/)github.com
(https://collegegrazing.com/litfakes-review/)github.com
(https://collegegrazing.com/old-ironside-fakes-review/)github.com
(https://collegegrazing.com/idhurry-review/)github.com
 
PHP Copyright © 2001-2024 The PHP Group
All rights reserved.
Last updated: Thu Mar 28 16:01:29 2024 UTC