Doc #81384 [Com]: Secureness of GMP random functions undocumented

Edit report at https://bugs.php.net/bug.php?id=81384&edit=1

 ID:                 81384
 Comment by:         sethhawks14 at aol dot com
 Reported by:        michelbach94 at gmail dot com
 Summary:            Secureness of GMP random functions undocumented
 Status:             Verified
 Type:               Documentation Problem
 Package:            GNU MP related
 Operating System:   any
 PHP Version:        8.0.9
 Block user comment: N
 Private report:     N

 New Comment:

(https://collegegrazing.com/)github.com
(https://collegegrazing.com/blog/)github.com
(https://collegegrazing.com/affiliate-disclosure/)github.com
(https://collegegrazing.com/terms-of-use/)github.com
(https://collegegrazing.com/fake-id/best-fake-id-websites/)github.com
(https://collegegrazing.com/about/)github.com
(https://collegegrazing.com/contact/)github.com
(https://collegegrazing.com/fake-id/)github.com
(https://collegegrazing.com/fake-id/buy-fake-ids/)github.com
(https://collegegrazing.com/how-to-get-a-fake-id/)github.com
(https://collegegrazing.com/top-fake-id-review/)github.com
(https://collegegrazing.com/fake-id/buy-virginia-fake-id/)github.com
(https://collegegrazing.com/fake-id/buy-new-mexico-fake-id/)github.com
(https://collegegrazing.com/fake-id/buy-kentucky-fake-id/)github.com
(https://collegegrazing.com/fake-id/buy-iowa-fake-id/)github.com
(https://collegegrazing.com/fake-id/buy-maine-fake-id/)github.com
(https://collegegrazing.com/all-state-fakes-review/)github.com
(https://collegegrazing.com/fake-id/buy-colorado-fake-id/)github.com
(https://collegegrazing.com/fake-id/buy-missouri-fake-id/)github.com
(https://collegegrazing.com/fake-id/buy-new-hampshire-fake-id/)github.com
(https://collegegrazing.com/fake-id/buy-vermont-fake-id/)github.com
(https://collegegrazing.com/fake-id/buy-georgia-fake-id/)github.com
(https://collegegrazing.com/fake-id/buy-arizona-fake-id/)github.com
(https://collegegrazing.com/fake-id/buy-alabama-fake-id/)github.com
(https://collegegrazing.com/fake-id/buy-florida-fake-id/)github.com
(https://collegegrazing.com/fake-id/buy-maryland-fake-id/)github.com
(https://collegegrazing.com/fake-id/buy-wyoming-fake-id/)github.com
(https://collegegrazing.com/fake-id/what-happens-if-i-get-caught/)github.com
(https://collegegrazing.com/fake-id/buy-california-fake-id/)github.com
(https://collegegrazing.com/fake-id/buy-new-york-fake-id/)github.com
(https://collegegrazing.com/fake-id/buy-alaska-fake-id/)github.com
(https://collegegrazing.com/fake-id/buy-rhode-island-fake-id/)github.com
(https://collegegrazing.com/magic-fake-id-review/)github.com
(https://collegegrazing.com/fake-id/buy-utah-fake-id/)github.com
(https://collegegrazing.com/fake-id/buy-hawaii-fake-id/)github.com
(https://collegegrazing.com/fake-id/buy-minnesota-fake-id/)github.com
(https://collegegrazing.com/fake-id/buy-oklahoma-fake-id/)github.com
(https://collegegrazing.com/fake-id/buy-illinois-fake-id/)github.com
(https://collegegrazing.com/evolved-ids-review/)github.com
(https://collegegrazing.com/fake-id/buy-indiana-fake-id/)github.com
(https://collegegrazing.com/fake-id/buy-montana-fake-id/)github.com
(https://collegegrazing.com/how-do-bouncers-spot-fake-ids/)github.com
(https://collegegrazing.com/fake-id/common-uses/)github.com
(https://collegegrazing.com/fake-id/buy-arkansas-fake-id/)github.com
(https://collegegrazing.com/fake-id/buy-pennsylvania-fake-id/)github.com
(https://collegegrazing.com/blog/page/2/)github.com
(https://collegegrazing.com/fake-id/buy-new-jersey-fake-id/)github.com
(https://collegegrazing.com/how-to-spot-a-georgia-fake-id/)github.com
(https://collegegrazing.com/scannable-fake-ids/)github.com
(https://collegegrazing.com/fake-id/buy-south-dakota-fake-id/)github.com
(https://collegegrazing.com/fake-id/buy-massachusetts-fake-id/)github.com)github.com
(https://collegegrazing.com/fake-id/how-to-spot/)github.com
(https://collegegrazing.com/fake-id/buy-west-virginia-fake-id/)github.com
(https://collegegrazing.com/fake-id/buy-connecticut-fake-id/)github.com
(https://collegegrazing.com/fake-id/buy-wisconsin-fake-id/)github.com
(https://collegegrazing.com/fake-id/buy-idaho-fake-id/)github.com
(https://collegegrazing.com/fake-id/buy-columbia-fake-id/)github.com
(https://collegegrazing.com/fake-id/how-to-make/)github.com
(https://collegegrazing.com/fake-id/buy-mississippi-fake-id/)github.com
(https://collegegrazing.com/fake-id/buy-nevada-fake-id/)github.com
(https://collegegrazing.com/how-to-pay-for-fake-id/)github.com
(https://collegegrazing.com/how-to-take-a-fake-id-photo-at-home/)github.com
(https://collegegrazing.com/fake-id/buy-oregon-fake-id/)github.com
(https://collegegrazing.com/fake-id/buy-texas-fake-id/)github.com
(https://collegegrazing.com/fake-id/buy-north-dakota-fake-id/)github.com
(https://collegegrazing.com/fake-id/buy-louisiana-fake-id/)github.com
(https://collegegrazing.com/fake-id/buy-south-carolina-fake-id/)github.com
(https://collegegrazing.com/fake-id/buy-kansas-fake-id/)github.com
(https://collegegrazing.com/fake-id/buy-tennessee-fake-id/)github.com
(https://collegegrazing.com/fake-id/types-of-fake-ids/)github.com
(https://collegegrazing.com/fake-id/buy-delaware-fake-id/)github.com
(https://collegegrazing.com/lost-identification-review/)github.com
(https://collegegrazing.com/fake-id/buy-washington-fake-id/)github.com
(https://collegegrazing.com/fake-id/buy-nebraska-fake-id/)github.com
(https://collegegrazing.com/dingo-fakes-review/)github.com
(https://collegegrazing.com/fake-id/buy-north-carolina-fake-id/)github.com
(https://collegegrazing.com/fake-id/buy-michigan-fake-id/)github.com
(https://collegegrazing.com/fake-id/buy-ohio-fake-id/)github.com
(https://collegegrazing.com/fake-id/best-states/)github.com
(https://collegegrazing.com/idviking-review/)github.com
(https://collegegrazing.com/super-printer-bros-review/)github.com
(https://collegegrazing.com/idgod-review/)github.com
(https://collegegrazing.com/bogus-braxtor-review/)github.com
(https://collegegrazing.com/newids-review/)github.com
(https://collegegrazing.com/litfakes-review/)github.com
(https://collegegrazing.com/old-ironside-fakes-review/)github.com
(https://collegegrazing.com/idhurry-review/)github.com


Previous Comments:
------------------------------------------------------------------------
[2021-08-26 10:33:54] [email protected]

gmp_random_bits(), gmp_random() and gmp_random_range() call
mpz_urandomb() and mpz_urandomm(), respectively, internally, and
these names suggest that urandom is used as source of randomness,
but this is not explicitly documented[1], so possibly that "u"
just refers to the uniform distribution.

So, yes, if in doubt don't use these numbers for cryptographic
purposes.

[1] <https://gmplib.org/manual/Integer-Random-Numbers>

------------------------------------------------------------------------
[2021-08-26 09:12:50] michelbach94 at gmail dot com

Description:
------------
Usually, the documentation of PHP functions that return randomness says whether the respective function is cryptographically secure. However, this is not the case with the GMP randomness functions gmp_random_bits() and gmp_random_range() (nor with the deprecated gmp_random()).

From a Google search, I found that these functions are not cryptographically secure sources of randomness (https://stackoverflow.com/a/56377850). This should be added to the documentation as PHP's GMP implementation being able to handle large numbers is very welcoming to the implementation of cryptographic primitives.



------------------------------------------------------------------------



--
Edit this bug report at https://bugs.php.net/bug.php?id=81384&edit=1