Accessing pseudo random data with PHP

PHP has two random number implementations at the moment rand() and mt_rand(), the former being a wrapper around the libc rand function and the latter being a implementation of the Mersenne Twister algorithm. Both of these are reasonable for generating random numbers but due to the fact that they're only seeded with a 32-bit number they are not suitable for cryptographic purposes.

Stefan Esser has a good article about the common pitfalls that most application developers fall into it when attempting to generate random values.

Most operating systems provide some sort of random number functionality, on Windows we have the CryptoAPI which samples various bits of information about the system creating a system wide seed. This includes monitoring the system counter, free disk clusters, memory status and other process information. With most varieties of Linux we have /dev/random which collects noise from device drivers and on some of the BSD based systems there is arc4random.

With all these potential different ways to get some pseudo random data it would be hard to do this in native PHP. Now we could do this in C and implement all the code ourselves but why risk implementing our own random functions and potentially making a mistake?

The answer is OpenSSL, we already have an OpenSSL module and obviously they have some random functionality built in for when you go to generate SSL certificates. So from PHP 5.3 access to the OpenSSL random number generator.

string openssl_random_pseudo_bytes(integer length [, &bool strong_result])

The return value and first parameter of this function should be pretty straight forward, you pass in a length and the random number generator returns a string of this length.

$random = openssl_random_pseudo_bytes(512);

On error this function will return false, the second parameter is a reference to a variable that will be set to true if the result is cryptographically strong.

$random = openssl_random_pseudo_bytes(512, $strong);

If $strong is true then the value of $random is considered cryptographically secure, if you don't care then just ignore the second parameter.

Comments

[Cheap Computer Canada]

Interesting an informative sites are what motivates me to visit them again.

[Anavar]

Great post! Thanks for sharing, I first read about pseudo random data with PHP.

[coach sale]

Beautiful young people are the whimsey of nature, but beautiful old people are true works of art. But you don't become "beautiful" just by virtue of the aging process.

[cheap computers canada]

Very informative blog! such blogs gives the knowledge that how different things can be done like this one pseudo random data can be read with PHP. keep sharing such kind of information in future.

[gucci medium black tote]

The data rate you are seeing is normal for mobile midband.
Your data rate depends on a number of factors, some of them are:

[Coach bags]

Great post! Thanks for sharing, I first read about pseudo random data with PHP.

[Coach bags]

Great post! Thanks for sharing, I first read about pseudo random data with PHP.

[louis vuitton bags]

Interesting an informative sites are what motivates me to visit them again.

[gucci medium black tote]

It's absolutely Perfect!I love the way on how you decorate those frames on the wall, and it goes with the floor too.Cool!

[louis]

I think its a pretty good idea not that there aren't other sites out there that already do something similar but I think it might catch on here pretty well.

[jordan 11]

All men are liable to error; and most men are, in many points, by passion or interest, under temptation to it. What do you think?

[cheap ugg boots]

I think its a pretty good idea !

[accessorize]

You say well, I am agree with you very much. It is your best choice.

[Cheap Computers]

very good idea, love to visits these sites again and again..

[Yeast infection home remedy]

ACCESSING PSEUDO RANDOM DATA WITH PHP is a good way to get it done, i have been implementing this stuff for few of my clients sites it worked well with dbs.

[Yeast infection pictures]

how can we expect the data will be passed fully?

[cheap adidas shoes]

I will try to use it and see what happens :) Wish me good luck.

[louis vuitton]

Today, I am holding this authentic Louis Vuitton ARTSY MM handbag to go to work, because this bag is expensive, so that I must Hermes Original Python Birkin 30 Grey take it careful. I am afraid that it lv cabas rivington will break by others. I was always fake louis vuitton worried about the bag, I feel very tired, a replica handbag blog will no need to upset hebgm100914.

[Tyree]

Thanks for the review. It’s very informative.
http://www.filecatch.com/trends/kw/14-09-2010.html

[jean]

too many browser and too many toolbar,I have no idea which one is better,and which two matches better,headache!

[jean]

Chinese Mid-AUTUMN Day is coming,hope for a holiday to take exercise，my p90x（http://www.albatouristik.com） plan is taking effects！

[jordan 4]

Competitive advantage is the secret of the innovation, which now than in any time in history.
Creativity is necessary for innovation, we should advocate creativity, then turn it into a creative, and this will lead to the successful innovation competition.

[Air yeezy]

Very educational blog! this sort of blogs provides the understanding that how distinctive items might be carried out such as this 1 pseudo arbitrary information might be study with PHP. maintain sharing this sort of sort of facts in future.

[Christmas gifts]

wow all those garments are so amazing and fabulous I don't come to your blog as often as I would like, but whenever I do I see some really amazing things keep up the good work! =)

[Louis Vuitton]

Nice, and thanks for sharing this info with us.Good Luck!