This repository was archived by the owner on Apr 11, 2025. It is now read-only.
This repository was archived by the owner on Apr 11, 2025. It is now read-only.
[SECURITY] phpsec/random.php - Fallback CSPRNG is not CSPRNG #116
Description
Note: I have been asked to log all the security issues that I have found by an OWASP contributor to support the decision to abandon this project. My personal opinion is that all of the code in this repository is beyond repair and that it is not wise to attempt to fix it.
The fallback CSPRNG (which is actually the main CSPRNG due to #113) generates random numbers with a ridiculously high number of collisions.
Even if this fallback isn't attempting to be a CSPRNG the concepts shouldn't be confused. Either users need a cryptographically secure random number or they need an error.