[TYPO3-core] RFC #9852: Feature: Provide a random byte generator in TYPO3 Core

[Dmitry Dulepov]

Hi!

Marcus Krause wrote:
> Problem:
> Currently TYPO3 does not provide a method for creation of random bytes.
> Random bytes are needed for cryptographic operations. Think of getting
> salted password hashes into core. Then the used salt should be as random
> as possible.
> As such method could be useful for TYPO3 extension developers or other
> use cases in TYPO3 Core, it should go into t3lib_div.
> 
> 
> Solution:
> Provide such method.

Comments on the patch (see updated patch in the attachment):

+	public static function generateRandomBytes($count)  {
+			// We initialize with the somewhat random PHP process ID on the
+			// first call.
+		if (empty($random_state)) {
+			$random_state = getmypid();
+		}


Condition is not necessary because $random_state will always be
empty when you enter the function. The assignment should be moved to
fallback branch.

+		if ($fh = @fopen('/dev/urandom', 'rb')) {
+			$output = fread($fh, $count);
+			fclose($fh);
+		}

The should be check for OS. Otherwise an attacker on Windows can
create such directory and file with predefined sequence. It is not
very difficult to do on Windows using WebDAV if permissions are wrong.

Additionally there should be extra pair of ( and ) because Zend
Studio complains about assignment in condition.

+		while (!isset($output{$count - 1})) {
+			$random_state = md5(microtime() . mt_rand() . $random_state);
+			$output .= md5(mt_rand() . $random_state, true);
+		}
+		return substr($output, 0, $count);

I am not a pro on random numbers generation, so I cannot comment on
it. OpenID library has its own method, which looks like this:

            $bytes = '';
            for ($i = 0; $i < $num_bytes; $i += 4) {
                $bytes .= pack('L', mt_rand());
            }
            $bytes = substr($bytes, 0, $num_bytes);

Is this better or worse?

I attached a bit reworked patch leaving fallback algorithm as is.

-- 
Dmitry Dulepov
TYPO3 translations support
My TYPO3 book: http://www.packtpub.com/typo3-extension-development/book
In the blog:
http://typo3bloke.net/post-details/typo3_43_cache_and_memcached_fix_ready/
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 9852_v2.diff
Type: text/x-diff
Size: 1281 bytes
Desc: not available
Url : http://lists.netfielders.de/pipermail/typo3-team-core/attachments/20081128/99624251/attachment.diff