Waiting on #2550519 to land.
Some points (in no particular order):
* In some configurations/versions of PHP, openssl_random_pseudo_bytes() may not return cryptographically secure random bytes, even if $strong is TRUE. We should 1) determine if this statement is true, and if so, 2) determine which configuration/versions of PHP it applies to so that we can advise our uses accordingly.
* If we find that our random bytes are not-so-random in the above point, we need to figure out if Drupal is exploitable because it, and if so, issue a PSA at a minimum (this part of the discussion should obviously not happen in public - cweagans will unpublish comments on this issue that even hint at an exploit. If you've found an exploit, please open a security issue right away).
* klausi did some profiling on https://www.drupal.org/node/2550519#comment-10591358 and found that there was a minor performance hit on fast hardware, and that performance hit became even more pronounced on slower hardware. This is all on Linux, however. Further testing on Windows and other configurations should be done to determine the real world implications of this - openssl_random_pseudo_bytes() appears to alleviate those problems, but I'm a little confused as to how that's possible if OpenSSL is using the best source of entropy available: both methods should be pulling from the same place, I think.
* random_compat adds support for libsodium - we should test the performance changes in an environment that has libsodium as well.
Comments
Comment #15
smustgrave commentedThank you for creating this issue to improve Drupal.
We are working to decide if this task is still relevant to a currently supported version of Drupal. There hasn't been any discussion here for over 8 years which suggests that this has either been implemented or is no longer relevant. Your thoughts on this will allow a decision to be made.
Since we need more information to move forward with this issue, the status is now Postponed (maintainer needs more info). If we don't receive additional information to help with the issue, it may be closed after three months.
Thanks!
Comment #16
smustgrave commentedWanted to bump 1 more time before closing, if no follow up in 3 months could be closed.