CRM_Core_Key - Improve entropy of "privateKey"
authorTim Otten <totten@civicrm.org>
Mon, 6 Apr 2020 06:33:55 +0000 (23:33 -0700)
committerSeamus Lee <seamuslee001@gmail.com>
Wed, 19 Aug 2020 06:16:57 +0000 (16:16 +1000)
commitadb0a2e204cdab4b4c97de46cf8d9bbdec8493e3
tree0a08b3c224f3865bb25d409f174f379fc59fcf54
parentdfe20f626c7d6e9eb2b80d9f19b9d5a7c0dfc2fd
CRM_Core_Key - Improve entropy of "privateKey"

In PHP 4/5, there was no good, universal source of entropy.  The old code
mitigated this by aggregating mediocre sources.  On my system, it appears
to be roughly:

* 2^31 for each `mt_rand()`
* 10^8 =~ 2^26 for each `uniqid(...TRUE)` (after discounting the non-random right half of the uniqid).

So that's ~114 bits (albeit low-quality bits).

In PHP 7, the docs describe `random_bytes()` as "generat[ing] cryptographically secure pseudo-random bytes."
CRM/Core/Key.php