How do you generate cryptographically secure random numbers with PHP?

views:

448

answers:

+3 Q:

How do you generate cryptographically secure random numbers with PHP?

We need to generate a cryptographically random string to use as an authentication token, which will be tied to session data in the database. We are using PHP, which doesn't appear to have a suitable random number generator built-in. How can we generate a cryptographically secure random string of N length using php?

Also note, due to the nature of our application, shell_exec is off the table.

+1 A:

what about uniqid? docs have an example of how it can be used for cookies/sessions.

SilentGhost 2009-10-11 15:31:00

This seems to be the best approach - when combined with mt_rand as described in the manual.

Travis 2009-10-11 16:13:24

Off the top of my head: take micro time, multiply it by microtime % 100 and do few randoms on sha1 of received result.

Eimantas 2009-10-11 15:31:58

That won't be very secure. Don't use the system clock unless you want the output to be predictable.

Dan Dyer 2009-10-11 15:37:14

+2 A:

Depending on your platform, you may use /dev/urandom or CAPICOM. This is nicely summarized in this comment from Mark Seecof.

codehead 2009-10-11 15:34:28

Thanks - I do believe this is the best way, since /dev/urandom uses a variety of entropy sources, rather than just the system clock. In my case, however, we will not be able to use fopen in this manner because we're basically working in a sandboxed environment.

Travis 2009-10-11 15:44:50

I think that you do not really need cryptographically secure random number for session handling. You can use built-in rand() function in for loop to get as much random symbols as you need. Or just stick to ol' trusty md5($salt.time().rand(10000).microtime())

n1313 2009-10-11 15:36:03

ansaurus

tags:

views:

answers:

How do you generate cryptographically secure random numbers with PHP?

related questions