{"action":"created","issue":{"url":"https://api.github.com/repos/DomBlack/php-scrypt/issues/44","repository_url":"https://api.github.com/repos/DomBlack/php-scrypt","labels_url":"https://api.github.com/repos/DomBlack/php-scrypt/issues/44/labels{/name}","comments_url":"https://api.github.com/repos/DomBlack/php-scrypt/issues/44/comments","events_url":"https://api.github.com/repos/DomBlack/php-scrypt/issues/44/events","html_url":"https://github.com/DomBlack/php-scrypt/issues/44","id":134557760,"number":44,"title":"Weak CSPRNG for the salt in some situations.","user":{"login":"AshleyPinner","id":6331215,"avatar_url":"https://avatars.githubusercontent.com/u/6331215?v=3","gravatar_id":"","url":"https://api.github.com/users/AshleyPinner","html_url":"https://github.com/AshleyPinner","followers_url":"https://api.github.com/users/AshleyPinner/followers","following_url":"https://api.github.com/users/AshleyPinner/following{/other_user}","gists_url":"https://api.github.com/users/AshleyPinner/gists{/gist_id}","starred_url":"https://api.github.com/users/AshleyPinner/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/AshleyPinner/subscriptions","organizations_url":"https://api.github.com/users/AshleyPinner/orgs","repos_url":"https://api.github.com/users/AshleyPinner/repos","events_url":"https://api.github.com/users/AshleyPinner/events{/privacy}","received_events_url":"https://api.github.com/users/AshleyPinner/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":6,"created_at":"2016-02-18T11:44:22Z","updated_at":"2016-05-18T14:10:25Z","closed_at":"2016-05-18T12:36:17Z","body":"https://github.com/DomBlack/php-scrypt/blob/master/scrypt.php#L69-L111\r\n\r\nThis code seems to do the following to try generate a salt:\r\n* Try use mcrypt_create_iv\r\n* Try use openssl_random_pseudo_bytes\r\n* Try use /dev/urandom\r\n* use mt_rand\r\n\r\nThis is a flawed approach (mainly because of windows/lack of sanity checking/usage of mt_rand). In general, you should consider the following path:\r\n*  Use libsodium if available.\r\n*  fread() /dev/urandom if available (never on Windows)\r\n*  mcrypt_create_iv($bytes, MCRYPT_DEV_URANDOM)\r\n*  COM('CAPICOM.Utilities.1')->GetRandom()\r\n*  openssl_random_pseudo_bytes() (absolute last resort)\r\n*  if none of the above, FAIL. Your execution can't continue past this point if the platform is unable to give you sufficient randomness for the salt.\r\n\r\nYou also _must_ check when you read /dev/urandom that you've been provided with a char device, rather than something pretending to be /dev/urandom.\r\n\r\nTo be honest, though, it's best to just look at including/requiring something like https://github.com/paragonie/random_compat/releases and just using `random_bytes()` as this'll then ensure you get the right amount of randomess on any platform that this code could possibly run under."},"comment":{"url":"https://api.github.com/repos/DomBlack/php-scrypt/issues/comments/220037852","html_url":"https://github.com/DomBlack/php-scrypt/issues/44#issuecomment-220037852","issue_url":"https://api.github.com/repos/DomBlack/php-scrypt/issues/44","id":220037852,"user":{"login":"paragonie-scott","id":11591518,"avatar_url":"https://avatars.githubusercontent.com/u/11591518?v=3","gravatar_id":"","url":"https://api.github.com/users/paragonie-scott","html_url":"https://github.com/paragonie-scott","followers_url":"https://api.github.com/users/paragonie-scott/followers","following_url":"https://api.github.com/users/paragonie-scott/following{/other_user}","gists_url":"https://api.github.com/users/paragonie-scott/gists{/gist_id}","starred_url":"https://api.github.com/users/paragonie-scott/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/paragonie-scott/subscriptions","organizations_url":"https://api.github.com/users/paragonie-scott/orgs","repos_url":"https://api.github.com/users/paragonie-scott/repos","events_url":"https://api.github.com/users/paragonie-scott/events{/privacy}","received_events_url":"https://api.github.com/users/paragonie-scott/received_events","type":"User","site_admin":false},"created_at":"2016-05-18T14:10:25Z","updated_at":"2016-05-18T14:10:25Z","body":"This is, by the way, a sequel to #20 "}}