Tweet
Tweet

Slide 1

Slide 1 text

joind.in/talk/d4f3a @SammyK #phptek PHP[TEK] 2018 Wifi: Sheraton Conference Pass: phptek2018 Twitter: #phptek Rate the Talks https:/ /joind.in/event/phptek-2018

Slide 2

Slide 2 text

Random Under the hood of PHP 7’s Let’s get CSPRNG Sammy Kaye Powers 2018-05-31

Slide 3

Slide 3 text

joind.in/talk/d4f3a @SammyK #phptek Thanks to Our Sponsors

Slide 4

Slide 4 text

joind.in/talk/d4f3a @SammyK #phptek Slides Get the joind.in/talk/d4f3a

Slide 5

Slide 5 text

joind.in/talk/d4f3a @SammyK #phptek CSPRNG? What is the PHP 7

Slide 6

Slide 6 text

joind.in/talk/d4f3a @SammyK #phptek random_int() random_bytes()

Slide 7

Slide 7 text

joind.in/talk/d4f3a @SammyK #phptek ext/standard/random.c

Slide 8

Slide 8 text

joind.in/talk/d4f3a @SammyK #phptek The end

Slide 9

Slide 9 text

joind.in/talk/d4f3a @SammyK #phptek Random? What is

Slide 10

Slide 10 text

joind.in/talk/d4f3a @SammyK #phptek

Slide 11

Slide 11 text

joind.in/talk/d4f3a @SammyK #phptek

Slide 12

Slide 12 text

joind.in/talk/d4f3a @SammyK #phptek

Slide 13

Slide 13 text

joind.in/talk/d4f3a @SammyK #phptek Meaning Is there to these “random” things?

Slide 14

Slide 14 text

joind.in/talk/d4f3a @SammyK #phptek Experiment I did an on myself

Slide 15

Slide 15 text

joind.in/talk/d4f3a @SammyK #phptek

Slide 16

Slide 16 text

joind.in/talk/d4f3a @SammyK #phptek 42

Slide 17

Slide 17 text

joind.in/talk/d4f3a @SammyK #phptek

Slide 18

Slide 18 text

joind.in/talk/d4f3a @SammyK #phptek

Slide 19

Slide 19 text

joind.in/talk/d4f3a @SammyK #phptek

Slide 20

Slide 20 text

joind.in/talk/d4f3a @SammyK #phptek

Slide 21

Slide 21 text

joind.in/talk/d4f3a @SammyK #phptek

Slide 22

Slide 22 text

joind.in/talk/d4f3a @SammyK #phptek

Slide 23

Slide 23 text

joind.in/talk/d4f3a @SammyK #phptek

Slide 24

Slide 24 text

joind.in/talk/d4f3a @SammyK #phptek

Slide 25

Slide 25 text

joind.in/talk/d4f3a @SammyK #phptek Every wher

Slide 26

Slide 26 text

joind.in/talk/d4f3a @SammyK #phptek Finish this sentence On the way home I got a flat ____. tire

Slide 27

Slide 27 text

joind.in/talk/d4f3a @SammyK #phptek Think of a two-digit number both digits different from each other both digits odd between 1 and 100

Slide 28

Slide 28 text

joind.in/talk/d4f3a @SammyK #phptek Are you thinking of… 37

Slide 29

Slide 29 text

joind.in/talk/d4f3a @SammyK #phptek

Slide 30

Slide 30 text

joind.in/talk/d4f3a @SammyK #phptek 11 random? What makes a number

Slide 31

Slide 31 text

joind.in/talk/d4f3a @SammyK #phptek 2, 4, 6, 8, __ 10

Slide 32

Slide 32 text

joind.in/talk/d4f3a @SammyK #phptek 1337, 42, 0, _ ?

Slide 33

Slide 33 text

joind.in/talk/d4f3a @SammyK #phptek 1337, 42, 0, 1337, 42, 0, 1337, __ 42

Slide 34

Slide 34 text

joind.in/talk/d4f3a @SammyK #phptek Random? What is isn’t Deterministic

Slide 35

Slide 35 text

joind.in/talk/d4f3a @SammyK #phptek “True” Random Measurement of atmospheric noise Count of the number of electrons coming off of a radioactive material

Slide 36

Slide 36 text

No content

Slide 37

Slide 37 text

joind.in/talk/d4f3a @SammyK #phptek Can I haz random number?

Slide 38

Slide 38 text

joind.in/talk/d4f3a @SammyK #phptek

Slide 39

Slide 39 text

joind.in/talk/d4f3a @SammyK #phptek

Slide 40

Slide 40 text

joind.in/talk/d4f3a @SammyK #phptek *sigh* Take this. 42

Slide 41

Slide 41 text

joind.in/talk/d4f3a @SammyK #phptek

Slide 42

Slide 42 text

joind.in/talk/d4f3a @SammyK #phptek 0

Slide 43

Slide 43 text

joind.in/talk/d4f3a @SammyK #phptek 2,4,8, 7,5,1 ?

Slide 44

Slide 44 text

joind.in/talk/d4f3a @SammyK #phptek Number Generator …or “PRNG” for short Pseudorandom

Slide 45

Slide 45 text

joind.in/talk/d4f3a @SammyK #phptek Pseudorandom? How’s that different than just random? Deterministic

Slide 46

Slide 46 text

joind.in/talk/d4f3a @SammyK #phptek 2,4,8, 7,5,1 Generator Linear Congruential

Slide 47

Slide 47 text

joind.in/talk/d4f3a @SammyK #phptek Generator Linear Congruential

Slide 48

Slide 48 text

joind.in/talk/d4f3a @SammyK #phptek

Slide 49

Slide 49 text

joind.in/talk/d4f3a @SammyK #phptek The modulus The multiplier The increment The seed

Slide 50

Slide 50 text

joind.in/talk/d4f3a @SammyK #phptek

Slide 51

Slide 51 text

joind.in/talk/d4f3a @SammyK #phptek

Slide 52

Slide 52 text

joind.in/talk/d4f3a @SammyK #phptek 2,4,8, 7,5,

Slide 53

Slide 53 text

joind.in/talk/d4f3a @SammyK #phptek 2,4,8, 7,5, Deterministic

Slide 54

Slide 54 text

joind.in/talk/d4f3a @SammyK #phptek https://xkcd.com/221/

Slide 55

Slide 55 text

joind.in/talk/d4f3a @SammyK #phptek

Slide 56

Slide 56 text

joind.in/talk/d4f3a @SammyK #phptek

Slide 57

Slide 57 text

joind.in/talk/d4f3a @SammyK #phptek 8,7,5, 1,2,

Slide 58

Slide 58 text

joind.in/talk/d4f3a @SammyK #phptek 1,2,4, 8,7, BUT!

Slide 59

Slide 59 text

joind.in/talk/d4f3a @SammyK #phptek

Slide 60

Slide 60 text

5,1,2,4,8,7,5, 1,2,4,8,7,5,1, 2,4,8,7,5,1,2, 4,8,7,5,1,2,4, 8,7,5,1,2,4,8, 7,5,1,2,4, Predictable

Slide 61

Slide 61 text

joind.in/talk/d4f3a @SammyK #phptek LCG lcg_value() PHP has a combined

Slide 62

Slide 62 text

joind.in/talk/d4f3a @SammyK #phptek PRNG? Is there a better

Slide 63

Slide 63 text

joind.in/talk/d4f3a @SammyK #phptek Twister Mersenne mt_rand()

Slide 64

Slide 64 text

joind.in/talk/d4f3a @SammyK #phptek

Slide 65

Slide 65 text

mt_rand() 724937621,955931554,1407935661,821438740,109344 9922,603009103,1540988686,1028238631,798475733, 1057939018,671583233,1853117923,98760648,112245 3373,534404057,900958085,1712824654,476385742,2 9956470,362833620,424798798,746223917,942003531 ,320462445,673296853,1351199651,141566289,16454 09515,995047403,1216151582,1115999460,175322091 7,1312071810,1553254094,1622498991,2080099801,1 704834715,1537620663,1357630828,1317892558, 219,937-1

Slide 66

Slide 66 text

joind.in/talk/d4f3a @SammyK #phptek

Slide 67

Slide 67 text

mt_rand(0,99) 83,9,64,28,62,48,83,47,46,53,37,26,21,91,61,32,58,1,89,60,65,97,42,56,6,47,76,1 2,98,11,36,61,62,60,43,67,6,16,73,15,39,38,56,19,66,56,98,72,91,24,57,94,8,26,7 3,55,17,14,84,89,39,11,13,48,71,98,89,63,9,95,74,9,81,85,97,24,14,14,77,22,96,4 3,61,91,61,58,19,71,8,49,18,92,38,34,9,36,91,59,14,4,58,59,29,74,52,41,36,67,82 ,67,11,0,58,51,37,4,45,56,35,50,78,91,27,39,80,27,28,95,2,82,51,72,27,41,43,74, 7,82,59,89,72,9,22,61,75,27,64,16,77,57,31,29,59,47,14,67,89,33,94,33,94,22,11, 62,9,13,61,45,78,29,3,11,99,91,52,79,63,64,43,99,53,22,16,10,53,57,15,84,16,30, 17,10,3,35,0,45,83,11,70,66,37,14,59,41,46,52,53,53,62,56,41,82,40,99,8,92,96,2 2,22,43,35,60,45,77,26,96,45,51,62,77,64,23,52,17,17,97,93,57,43,56,45,62,42,24 ,62,1,59,38,70,13,34,32,48,47,1,42,48,18,2,59,47,53,10,3,66,68,93,4,53,85,20,77 ,63,43,45,16,15,77,73,89,11,64,76,30,46,91,1,85,96,19,63,70,62,35,58,95,63,38,7 8,83,8,97,22,2,28,51,25,29,98,62,74,59,95,79,74,66,47,35,83,56,49,25,32,25,46,1 3,69,77,30,94,24,31,68,23,64,47,28,33,65,69,16,0,98,37,85,93,60,24,10,54,50,42, 64,11,9,13,15,84,3,23,73,83,83,72,9,2,28,23,90,73,2,47,45,93,4,32,25,75,61,98,7 3,79,66,23,20,83,11,45,67,40,39,45,0,65,40,78,74,8,79,86,38,10,87,60,99,30,35,5 0,16,29,24,19,29,16,40,57,87,26,90,1,63,63,34,44,8,36,25,38,50,10,15,17,14,40,6 ,53,88,18,36,46,69,2,13,0,83,59,92,59,34,34,24,40,99,41,6,79,65,98,9,36,31,8,4, 89,98,91,80,42,10,26,72,40,50,39,25,33,45,24,70,54,89,91,53,23,12,20,40,21,25,5 5,48,11,3,84,42,5,7,21,58,85,18,52,92,94,69,20,49,3,8,55,57,4,38,52,37,64,55,82 ,98,5,75,84,35,14,99,74,23,41,69,55,53,22,52,6,68,35,38,73,52,22,52,86,79,15,38 ,3,20,99,36,23,77,33,80,16,97,54,88,11,77,77,99,70,26,5,75,87,4,23,8,50,79,61,5 5,80,25,58,79,25,56,9,81,6,42,27,90,58,6,62,74,25,79,81,61,23,54,92,53,16,66,22 ,49,77,97,84,25,49,32,49,65,51,1,93,63,68,69,67,10,44,99,44,42,89,35,24, 624 = busted

Slide 68

Slide 68 text

echo mt_rand(0,99); 11

Slide 69

Slide 69 text

echo mt_rand(0,99); 9

Slide 70

Slide 70 text

echo mt_rand(0,99); 60

Slide 71

Slide 71 text

mt_srand(10); echo mt_rand(0,99); 21

Slide 72

Slide 72 text

mt_srand(10); echo mt_rand(0,99); 21

Slide 73

Slide 73 text

mt_srand(10); echo mt_rand(0,99); 21

Slide 74

Slide 74 text

joind.in/talk/d4f3a @SammyK #phptek CSRF Take for example Tokens

Slide 75

Slide 75 text

joind.in/talk/d4f3a @SammyK #phptek Cross-site request forgery (CSRF) tokens help prevent unauthorized requests on a user’s behalf.

Slide 76

Slide 76 text

joind.in/talk/d4f3a @SammyK #phptek A CSRF token must be unique and unpredictable.

Slide 77

Slide 77 text

joind.in/talk/d4f3a @SammyK #phptek

Slide 78

Slide 78 text

joind.in/talk/d4f3a @SammyK #phptek

Slide 79

Slide 79 text

joind.in/talk/d4f3a @SammyK #phptek

Slide 80

Slide 80 text

joind.in/talk/d4f3a @SammyK #phptek I’ll just let PHP seed mt_rand() for me. Bad idea jeans *Old SNL skit reference

Slide 81

Slide 81 text

joind.in/talk/d4f3a @SammyK #phptek

Slide 82

Slide 82 text

joind.in/talk/d4f3a @SammyK #phptek What about rand() you ask?

Slide 83

Slide 83 text

joind.in/talk/d4f3a @SammyK #phptek Nope

Slide 84

Slide 84 text

joind.in/talk/d4f3a @SammyK #phptek rand() mt_rand() …in PHP 7.0 & below

Slide 85

Slide 85 text

joind.in/talk/d4f3a @SammyK #phptek rand() Uses the system PRNG (unreliable & inconsistent) Is a PRNG (totes predictable) Uniform distribution issues

Slide 86

Slide 86 text

joind.in/talk/d4f3a @SammyK #phptek Uniform Distribution

Slide 87

Slide 87 text

joind.in/talk/d4f3a @SammyK #phptek 0 0.05 0.1 0.15 0.2 1 2 3 4 5 6

Slide 88

Slide 88 text

joind.in/talk/d4f3a @SammyK #phptek 0 0.1 0.2 0.3 0.4 1 2 3 4 5 6

Slide 89

Slide 89 text

joind.in/talk/d4f3a @SammyK #phptek Uniform Distribution == True Random

Slide 90

Slide 90 text

joind.in/talk/d4f3a @SammyK #phptek mt_rand() Implements the MT algorithm incorrectly Is a PRNG (totes predictable) Has a modulo bias

Slide 91

Slide 91 text

joind.in/talk/d4f3a @SammyK #phptek Modulo Bias

Slide 92

Slide 92 text

joind.in/talk/d4f3a @SammyK #phptek 6 % 3 = 0 8 % 3 = 2 Modulo Operator

Slide 93

Slide 93 text

joind.in/talk/d4f3a @SammyK #phptek Random # between 0 & 1 n % 2 = 0 or 1 Use mod 2

Slide 94

Slide 94 text

joind.in/talk/d4f3a @SammyK #phptek rand_src() = 1, 2, or 3 2 % 2 = 0 3 % 2 = 1 1 is more likely 1 % 2 = 1

Slide 95

Slide 95 text

joind.in/talk/d4f3a @SammyK #phptek rand() mt_rand() …in PHP 7.1 & above

Slide 96

Slide 96 text

joind.in/talk/d4f3a @SammyK #phptek mt_rand() Fixes bug in MT algorithm implementation Is a PRNG (totes predictable)

Slide 97

Slide 97 text

joind.in/talk/d4f3a @SammyK #phptek They’re totes samezies! rand() mt_rand() ===

Slide 98

Slide 98 text

joind.in/talk/d4f3a @SammyK #phptek

Slide 99

Slide 99 text

joind.in/talk/d4f3a @SammyK #phptek rand() mt_rand() Both suffer from modulo bias &

Slide 100

Slide 100 text

joind.in/talk/d4f3a @SammyK #phptek Seeds aren’t impossible to predict

Slide 101

Slide 101 text

joind.in/talk/d4f3a @SammyK #phptek Entropy *Could be it’s own talk

Slide 102

Slide 102 text

joind.in/talk/d4f3a @SammyK #phptek A measure of how accurately we’re able to predict the next value in a sequence.* * oversimplification

Slide 103

Slide 103 text

joind.in/talk/d4f3a @SammyK #phptek High entropy harder to predict Low entropy easier to predict

Slide 104

Slide 104 text

joind.in/talk/d4f3a @SammyK #phptek High entropy harder to predict Good for random number generation

Slide 105

Slide 105 text

joind.in/talk/d4f3a @SammyK #phptek Cryptographically Pseudorandom Secure Number Generator

Slide 106

Slide 106 text

joind.in/talk/d4f3a @SammyK #phptek CSPRNG or…

Slide 107

Slide 107 text

joind.in/talk/d4f3a @SammyK #phptek “See Spring” or…

Slide 108

Slide 108 text

Unicorn Magical

Slide 109

Slide 109 text

Uses seeds that are really really really really ridiculously hard to guess

Slide 110

Slide 110 text

joind.in/talk/d4f3a @SammyK #phptek High Entropy wee!

Slide 111

Slide 111 text

joind.in/talk/d4f3a @SammyK #phptek impossible It’s values are to predict in practice 42 82 Suitable for use in cryptographic contexts.

Slide 112

Slide 112 text

mythical Where can we find this creature?

Slide 113

Slide 113 text

joind.in/talk/d4f3a @SammyK #phptek CSPRNG options in 5.x

Slide 114

Slide 114 text

joind.in/talk/d4f3a @SammyK #phptek openssl_random_pseudo_bytes() mcrypt_create_iv() /dev/urandom

Slide 115

Slide 115 text

joind.in/talk/d4f3a @SammyK #phptek openssl_random_pseudo_bytes() mcrypt_create_iv() /dev/urandom

Slide 116

Slide 116 text

joind.in/talk/d4f3a @SammyK #phptek Since the UNIX fork() system call duplicates the entire process state, a random number generator which does not take this issue into account will produce the same sequence of random numbers in both the parent and the child […], leading to cryptographic disaster… https://wiki.openssl.org/index.php/Random_fork-safety

Slide 117

Slide 117 text

joind.in/talk/d4f3a @SammyK #phptek OpenSSL’s be like 42 CSPRNG 82 82

Slide 118

Slide 118 text

joind.in/talk/d4f3a @SammyK #phptek OpenSSL cannot fix the fork-safety problem because its not in a position to do so. However, there are [solutions] available and they are listed below. https://wiki.openssl.org/index.php/Random_fork-safety

Slide 119

Slide 119 text

joind.in/talk/d4f3a @SammyK #phptek Don't use RAND_bytes https://wiki.openssl.org/index.php/Random_fork-safety

Slide 120

Slide 120 text

joind.in/talk/d4f3a @SammyK #phptek Instead, you can read directly from /dev/random, /dev/urandom or /dev/srandom; or use CryptGenRandom on Windows systems. https://wiki.openssl.org/index.php/Random_fork-safety

Slide 121

Slide 121 text

joind.in/talk/d4f3a @SammyK #phptek mcrypt_create_iv() /dev/urandom openssl_random_pseudo_bytes()

Slide 122

Slide 122 text

joind.in/talk/d4f3a @SammyK #phptek

Slide 123

Slide 123 text

joind.in/talk/d4f3a @SammyK #phptek

Slide 124

Slide 124 text

joind.in/talk/d4f3a @SammyK #phptek

Slide 125

Slide 125 text

joind.in/talk/d4f3a @SammyK #phptek /dev/urandom openssl_random_pseudo_bytes() mcrypt_create_iv()

Slide 126

Slide 126 text

joind.in/talk/d4f3a @SammyK #phptek open_basedir=/foo/dir

Slide 127

Slide 127 text

joind.in/talk/d4f3a @SammyK #phptek openssl_random_pseudo_bytes() mcrypt_create_iv() /dev/urandom

Slide 128

Slide 128 text

joind.in/talk/d4f3a @SammyK #phptek CSPRNG New goodness 7

Slide 129

Slide 129 text

joind.in/talk/d4f3a @SammyK #phptek CSPRNG random_int() random_bytes()

Slide 130

Slide 130 text

random_int(0,99) 6,17,6,9,17,53,58,98,46,44,62,9,76,65,46,21,42,5,65,34,11,96,85,7,46,89,98,9,9, 80,8,76,87,18,24,68,16,61,27,39,30,32,4,83,83,23,96,27,13,47,6,99,16,40,2,75,27 ,3,79,68,75,60,50,70,63,17,75,29,79,57,9,48,18,86,95,25,40,52,20,86,6,48,94,27, 76,14,9,27,62,14,68,58,12,18,63,19,84,47,7,13,63,28,66,55,2,75,44,92,11,85,51,1 7,42,57,22,4,53,7,3,76,48,55,95,7,45,33,87,36,11,17,66,6,46,87,57,48,22,31,65,5 ,26,10,47,82,97,74,25,32,63,60,29,53,13,24,56,54,52,86,67,4,94,35,48,73,35,45,2 4,74,74,83,49,70,41,49,20,60,29,49,30,35,38,63,4,86,72,97,26,22,36,95,59,94,24, 89,73,46,14,73,51,93,93,39,13,80,9,30,24,20,30,63,20,64,97,29,7,2,82,96,42,61,5 3,28,49,12,90,71,58,72,63,49,32,69,76,50,62,88,31,26,72,79,19,15,3,39,27,80,16, 65,62,53,82,59,23,85,95,41,68,86,3,92,76,91,88,12,20,96,14,35,50,94,24,23,44,55 ,78,65,81,7,1,86,32,58,46,97,43,78,9,51,1,6,79,73,49,13,40,21,90,14,9,70,95,88, 37,85,14,7,29,42,55,81,46,39,41,45,81,11,93,26,89,4,98,35,30,36,74,97,18,85,97, 23,52,64,88,20,89,12,25,19,21,21,50,60,50,43,84,1,52,5,19,2,86,38,51,48,30,55,9 0,93,97,52,84,29,58,96,78,37,24,14,72,81,9,82,26,83,83,17,35,15,9,87,95,51,71,4 8,9,45,13,61,98,3,18,96,99,28,74,47,58,71,89,68,57,51,86,90,38,21,72,72,30,22,1 3,88,25,48,45,62,59,81,32,10,54,82,60,90,17,98,41,73,98,60,22,99,66,32,41,82,62 ,91,3,85,91,21,17,98,19,48,50,24,67,3,14,62,55,35,99,95,83,76,12,51,77,61,24,24 ,60,15,31,47,24,27,97,98,70,6,24,25,20,23,67,72,55,47,19,53,50,38,22,76,37,63,8 2,67,52,3,75,84,84,71,49,79,26,89,11,77,55,92,32,81,38,23,54,9,40,80,75,20,7,58 ,37,72,75,59,46,32,41,82,90,72,59,5,42,2,94,44,44,4,15,37,29,24,10,51,18,8,42,5 6,9,68,31,99,7,77,59,8,74,80,11,15,93,81,5,72,44,49,39,25,4,18,98,0,93,42,78,36 ,57,47,16,49,2,85,6,31,17,81,10,54,40,95,68,31,80,29,41,86,32,9,58,96,62,79,25, 6,45,56,54,0,61,74,90,12,34,11,56,3,41,39,84,32,30,42,81,36,43,5,

Slide 131

Slide 131 text

joind.in/talk/d4f3a @SammyK #phptek bin2hex(random_bytes(16)) f7f5289027cb6c5116d 2d3cc78e5819c

Slide 132

Slide 132 text

joind.in/talk/d4f3a @SammyK #phptek You’re not strong until you’re crypto-strong!

Slide 133

Slide 133 text

CSPRNG under the hood

Slide 134

Slide 134 text

No content

Slide 135

Slide 135 text

joind.in/talk/d4f3a @SammyK #phptek On Windows: CryptGenRandom On BSD: arc4random_buf() On Linux: getrandom(2) syscall Read directly from /dev/urandom

Slide 136

Slide 136 text

Fail Closed

Slide 137

Slide 137 text

joind.in/talk/d4f3a @SammyK #phptek /dev/urandom So what is this thing?

Slide 138

Slide 138 text

/dev/urandom Gathers environmental noise from the system like… …device drivers, inter-keyboard timings, inter-interrupt timings from some interrupts, and other events which are both (a) non-deterministic and (b) hard for an outside observer to measure. https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/drivers/char/random.c

Slide 139

Slide 139 text

joind.in/talk/d4f3a @SammyK #phptek CSPRNG random_bytes() random_int() 7 /dev/urandom Powered by

Slide 140

Slide 140 text

joind.in/talk/d4f3a @SammyK #phptek Still on 5.x? paragonie/random_compat Polyfill for PHP 7 CSPRNG

Slide 141

Slide 141 text

joind.in/talk/d4f3a @SammyK #phptek TL;DR Never use LCG, MT, or any other PRNG in cryptographic contexts Only use a CSPRNG like /dev/urandom for crypto Use random_bytes() & random_int() in PHP (or install paragonie/random_compat)

Slide 142

Slide 142 text

joind.in/talk/d4f3a @SammyK #phptek More Resources

Slide 143

Slide 143 text

joind.in/talk/d4f3a @SammyK #phptek Recommendation for the Entropy Sources Used for Random Bit Generation Final Draft - NIST SP 800-90B https://csrc.nist.gov/publications/detail/sp/800-90b/final

Slide 144

Slide 144 text

joind.in/talk/d4f3a @SammyK #phptek New & improved man pages for /dev/urandom http://man7.org/linux/man-pages/man7/random.7.html

Slide 145

Slide 145 text

joind.in/talk/d4f3a @SammyK #phptek Myths about /dev/urandom Thomas Hühn https://www.2uo.de/myths-about-urandom/

Slide 146

Slide 146 text

joind.in/talk/d4f3a @SammyK #phptek Cracking Random Number Generators Three-part blog post series James Roper https://jazzy.id.au/2010/09/20/cracking_random_number_generators_part_1.html

Slide 147

Slide 147 text

joind.in/talk/d4f3a @SammyK #phptek How I Met Your Girlfriend DEF CON 18 Samy Kamkar https://www.youtube.com/watch?v=fWk_rMQiDGc

Slide 148

Slide 148 text

joind.in/talk/d4f3a @SammyK #phptek Weak RNG in PHP session ID generation leads to session hijacking Andreas Bogk http://seclists.org/fulldisclosure/2010/Mar/519

Slide 149

Slide 149 text

joind.in/talk/d4f3a @SammyK #phptek

Slide 150

Slide 150 text

joind.in/talk/d4f3a @SammyK #phptek Thanks @hfronz! ❤

Slide 151

Slide 151 text

joind.in/talk/d4f3a @SammyK #phptek Sammy Kaye Powers Thanks! /talk/d4f3a @SammyK SammyK.me Host of @PHPRoundtable Thanks @hfronz! ❤