Removed the OpenSSL usage #16
Conversation
| functions [random_bytes](http://php.net/manual/en/function.random-bytes.php) and | ||
| [random_int](http://php.net/manual/en/function.random-int.php), otherwise we use the | ||
| [Mcrypt](http://it.php.net/manual/en/book.mcrypt.php) extension or /dev/urandom source with a mixer | ||
| function provided by . If you don't have a secure random source in your environment the component |
|
@Ocramius I used function_exists() as suggested, thanks! |
|
@weierophinney I think the PR is ready to be merged. |
| @@ -56,7 +54,7 @@ public static function getBytes($length, $strong = false) | |||
| if (true === $strong && false === $checkAlternatives) { | |||
| throw new Exception\RuntimeException( | |||
| 'This PHP environment doesn\'t support secure random number generation. ' . | |||
| 'Please consider installing the OpenSSL and/or Mcrypt extensions' | |||
| 'Please consider installing Mcrypt extension or use PHP 7' | |||
There was a problem hiding this comment.
Rephrase this to "Please consider either installing ext/mcrypt or upgrading to PHP 7".
|
@ezimuel Just a few notes about exceptions to address, and then I can merge. I'm assuming this would be for a new minor release? |
Removed the OpenSSL usage
|
Merged to develop for release with 2.7.0. |
|
Isn't this considered backwards incompatible because developer action is required when you happen to have neither mcrypt nor the RandomLib installed? After updating to 2.7.0 my application now throws the "The RandomLib fallback pseudorandom generator is not installed" exception when using Zend\Validator\Csrf (which calls Zend\Math\Rand::getBytes). Shouldn't have the openSSL usage been marked as deprecated before in 2.6.0 so developers could prepare? I understand that there are security implications but are they important enough to force the BC break? |
|
If this is considered a security issue, it takes priority over BC compat. Depends on @ezimuel's decision tho. |
|
I see, thanks for clearing that up! |
|
@j-schumann yes, this is considered as a potential security issue for some specific OpenSSL installation, see #70014. |
|
Thanks! :) |
|
@j-schumann there are also other issues around the usage of OpenSSL, see comments reported here. |
This PR removes the usage of the
openssl_random_pseudo_bytes()function of OpenSSL due to the bug #70014 and the discussion reported here.