Generate cryptographically secure random numbers in php

by

Pseudorandom number generators (PRNG) are very complex beast.

There are no real “perfect” random number generators — in fact the best that can be done from mathematical functions are pseudorandom — they seem random enough for most intents and purposes.

In fact, performing any additional actions from a number returned by a PRNG doesn’t really increase its randomness, and in fact, the number can become less random.

So, my best advice is, don’t mess around with values returned from a PRNG. Use a PRNG that is good enough for the intended use, and if it isn’t, then find a PRNG that can produce better results, if necessary.

And frankly, it appears that the mt_rand function uses the Mersenne twister, which is a pretty good PRNG as it is, so it’s probably going to be good enough for most casual use.

However, Mersenne Twister is not designed to be used in any security contexts. See this answer for a solution to use when you need randomness to ensure security.

Edit

There was a question in the comments why performing operations on a random number can make it less random. For example, some PRNGs can return more consistent, less random numbers in different parts of the bits — the high-end can be more random than the low-end.

Therefore, in operations where the high-end is discarded, and the low end is returned, the value can become less random than the original value returned from the PRNG.

I can’t find a good explanation at the moment, but I based that from the Java documentation for the Random.nextInt(int) method, which is designed to create a fairly random value in a specified range. That method takes into account the difference in randomness of the parts of the value, so it can return a better random number compared to more naive implementations such as rand() % range.

More Related Contents:

  1. Secure random number generation in PHP
  2. Generating a random password in php
  3. best practice to generate random token for forgot password
  4. An algorithm for Random Number Pair Generation [closed]
  5. Secure hash and salt for PHP passwords
  6. What are the best practices for avoiding xss attacks in a PHP site [closed]
  7. Do htmlspecialchars and mysql_real_escape_string keep my PHP code safe from injection?
  8. When should I use prepared statements?
  9. PHP Session Fixation / Hijacking
  10. “Keep Me Logged In” – the best approach
  11. How to properly add cross-site request forgery (CSRF) token using PHP
  12. How safe are PHP session variables?
  13. Preventing session hijacking
  14. Why is using a mysql prepared statement more secure than using the common escape functions?
  15. Stop people uploading malicious PHP files via forms
  16. “slash before every quote” problem [duplicate]
  17. How to create a laravel hashed password
  18. PHP: How To Disable Dangerous Functions
  19. How to prevent multiple logins in PHP website
  20. a better approach than storing mysql password in plain text in config file?
  21. Session hijacking and PHP
  22. Difference between mt_rand() and rand()
  23. Algorithm for generating a random number
  24. What does mysql_real_escape_string() do that addslashes() doesn’t?
  25. Session timeouts in PHP: best practices
  26. How random is PHP’s shuffle function?
  27. php random x digit number
  28. Unique key generation
  29. Is it possible to execute PHP with extension file.php.jpg?
  30. When to use filter_input()

Leave a Comment