About the random bytes generator

[ivantcholakov]

Line 116:

$rawBinary = mcrypt_create_iv($numInts * PHP_INT_SIZE, MCRYPT_DEV_URANDOM);

This is a dependency on mcrypt PHP extension. What about making random bytes generation more tollerant to system configuration? I found this: https://github.com/GeorgeArgyros/Secure-random-bytes-in-PHP

[defuse]

The best you can do in PHP is to try:

• Use mcrypt
• Use openssl
• Read directly from /dev/urandom

I might consider doing a second (separate) library that safely tries each of these, but for now it's as easy as apt-get install php5-mcrypt.

[glensc]

that library already exists: https://github.com/ircmaxell/RandomLib
no point invent another one

[ivantcholakov]

random_bytes() function could be used. For PHP 5.x the polyfill https://github.com/paragonie/random_compat could be proposed for installation through Composer.

[Pudge601]

Given the way that random_int works, am I right in thinking that it would actually make most of this library redundant? It seems to use a technique very similar to the one used in this library to be able to pick an un-biased int value between a min (e.g. 0) and max (e.g. character array length - 1).

With that in mind, the implementation of this library could be simplified all the way down to getting a random_int between 0 and N-1, and using the character at that index to build a string of the requested length.