Homec4science

Provide a random character string API for entropy consumers that need human…

Authored by epriestley <git@epriestley.com> on Oct 10 2011, 22:04.

Description

Provide a random character string API for entropy consumers that need human-readable entropy

Summary:
See T547. In a lot of places we do sha1(Filesystem::readRandomBytes(20)) but
this is a little silly and makes it harder to audit the use of hash functions.

Provide an API to generate a random, human-readable alphanumeric character
string of specified length.

Test Plan:
php> =Filesystem::readRandomCharacters(20);
"wt5bju6nf6r5jkjczm5a"
php> =Filesystem::readRandomCharacters(20);
"arqwgvbugmac3jarss33"
php> =Filesystem::readRandomCharacters(20);
"z4hhzigbbnvzqwjrcl7l"
php> =Filesystem::readRandomCharacters(20);
"37hamjn75dv4i4miiulr"

I generated a frequency count for a 1MB string:

array(
  "a" => 32711,
  "b" => 32704,
  "c" => 32866,
  "d" => 32727,
  "e" => 33003,
  "f" => 32688,
  "g" => 32327,
  "h" => 32861,
  "i" => 33135,
  "j" => 32675,
  "k" => 32824,
  "l" => 32688,
  "m" => 32806,
  "n" => 32660,
  "o" => 32911,
  "p" => 33038,
  "q" => 32378,
  "r" => 32731,
  "s" => 32947,
  "t" => 32553,
  "u" => 32760,
  "v" => 32847,
  "w" => 32649,
  "x" => 32601,
  "y" => 32725,
  "z" => 32697,
  2 => 32630,
  3 => 32795,
  4 => 32862,
  5 => 33044,
  6 => 32904,
  7 => 32829,
)

This distribution gives me reasonable confidence that I didn't break anything
with the algorithm.

Picking the high 5 bits is a little suspicious but no reasonable random source
should have entropy problems with this and an implementation which uses all the
bits is either sort of cargo cultey ("I can mix bits better than the system!")
or comparatively complicated (lots of bit fiddling).

Notably, base_convert() uses a floating point representation internally and is
not appropriate.

Reviewers: jungejason, benmathews

Reviewed By: jungejason

CC: aran, jungejason, epriestley

Differential Revision: 999

Details

Committed
epriestley <git@epriestley.com>Oct 10 2011, 22:35
Pushed
aubortMar 17 2017, 12:03
Parents
rPHUf6f64640ab51: Only automatically link protocols from a protocol whitelist
Branches
Unknown
Tags
Unknown

Event Timeline

epriestley <git@epriestley.com> committed rPHU1e373d960158: Provide a random character string API for entropy consumers that need human… (authored by epriestley <git@epriestley.com>).Oct 10 2011, 22:35