All Questions

Tagged with
Filter by
Sorted by
Tagged with
1
vote
1answer
270 views

How to reverse engineer str_shuffle (PHP) to get its mt_rand outputs

$output = str_shuffle("12345"); E.g. $output is now 25134 How do I find out what numbers came out of mt_rand() to allow for the shuffle I want to know this because I want the seed of mt_rand() and ...
0
votes
1answer
221 views

Is a substring of base64 encoded random_bytes less secure then just using random_bytes

$bytes = random_bytes(15); $encoded = base64_encode($bytes); $output = substr($encoded, 0, 15); Does this code affect the complexity of the output vs just using $output = random_bytes(15); I think ...
1
vote
0answers
154 views

Problem in Cracking PHP rand() seed on windows

I read this article https://www.sjoerdlangkemper.nl/2016/02/11/cracking-php-rand/ about cracking php rand() function. and I involved with some problems on testing methods mentioned in article. I used ...
-1
votes
3answers
992 views

Generate a truly random text string with PHP? [duplicate]

How can I generate a truly cryptographically secure random text string in PHP (to be used as password)? Allowed: a-z, A-Z, 0-9 Blocked: Everything else
2
votes
2answers
601 views

Do I need a “cryptographically secure” random value for an unguessable URL?

tl;dr: Is a pseudorandomly generated string unguessable enough to be used as token in a URL? I'm making a web application, let's for the sake of argument assume it's another PasteBin. I allow users ...
0
votes
1answer
219 views

Is this PHP RNG safe?

I need to generate a 20 character long random string free from any vowels, and thus far I have the following function to carry out the task. function random_str() { $i = 1; $secret = ''; ...
4
votes
3answers
360 views

Predictability of PHPs array_rand

It's generally known information that methods such as the array_rand() method in PHP are not considered cryptographically secure. I'm trying to understand under what situations generated result may be ...
6
votes
3answers
14k views

Can I rely on openssl_random_pseudo_bytes() being very random in PHP?

I came across an application which needs to generate a random token for each user. It is very important that each generated token is unique. Application code was as follows: $token = md5(...
3
votes
1answer
3k views

Correct way to generate password salts in PHP 5.3 on Linux given my constraints?

In examining our database storage of hashed passwords with salts, I note a high rate of salt collisions, i.e., there are far too many cases where two table rows have the same salt stored. One ...
1
vote
3answers
5k views

Token-based authentication - what's a good token length?

What's a good token character length for a token-based login? Currently I'm using the following code: <?php $token = bin2hex(openssl_random_pseudo_bytes(16)); Is 16 sufficient or should I ...
3
votes
2answers
248 views

How can you detect an insecure, non-random token?

I know that some of PHP's random functions are insecure due to them not being completely random and are considered a bad practice. My question is how an attacker go about finding that the developer ...
0
votes
1answer
143 views

is this code valid for securing passwords? [duplicate]

i was wondering if this is a secure method for a hashing password.if it is not secure please tell me what to do in order to make it secure $pass='test'//the password $salt=openssl_random_pseudo_bytes(...
1
vote
1answer
5k views

Generating a TRULY random string in PHP [duplicate]

I need to generate thousands (possibly millions) of unique codes for a client. These codes may have a monetary value, so it's vital that they are TRULY random, and that no pattern could be spotted and ...
1
vote
1answer
2k views

Using Random Numbers As Session variables

I am using randomly generated numbers as session variables to identify the sessions in a PHP application. To make further security proof what ways should I follow?
3
votes
2answers
1k views

Is mt_rand() suitable for generating a salt?

Assumed I have to following code in order to generate a random blowfish salt for saving a new password: $blowfishCharacters = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789./'; $salt ...
6
votes
2answers
7k views

Should I use urandom() or openssl_random_pseudo_bytes()?

I am developing a site in PHP 5.4. Which function is better to use to generate a random salt for password security? $salt = sha1(openssl_random_pseudo_bytes(23)); or $seed = ''; $a = @fopen('/dev/...
3
votes
3answers
429 views

PRNG: Does combining insecure algos help?

Reading about how insecure PHP's rand function is, I was wondering if it helps to combine random functions. The suggested function there, openssl_random_pseudo_bytes, can also be cryptographically ...
8
votes
4answers
7k views

How insecure are PHP's rand functions?

There are some pseudo-random-number generators in PHP: rand(), srand(), mt_rand(), mt_srand(). You can look at their code here. I understand those functions are insecure, but how insecure are they? ...
22
votes
5answers
2k views

Hashed password storage with random salt

Ever since I've been making sites that require a user to log in with a username and password I've always kept the passwords somewhat secure by storing them in my database hashed with a salt phrase. ...
7
votes
2answers
366 views

What to consider when generating random code as part of two-factor authentication?

I want to write a patch for a two factor authentication system that someone else has started. The code is a module for a PHP content management system and sends an SMS message to a user's phone, after ...
4
votes
2answers
2k views

Is this algorithm for a random string cryptographically secure?

I've pieced together this algorithm (if it can be called that) from various bits of code I've seen online, and I'm wondering how cryptographically secure it is. It's used to generate passwords: ...