Re: Safe session IDs

From: Ryan M Harris (rmharrisat_private)
Date: Fri Jan 11 2002 - 08:45:07 PST

  • Next message: Jan Lehnardt: "Re: Safe session IDs"

    First of all thank you all for the help.  I sent a reply directly only to
    people who had mentioned something that I can't use, and gave a reason.
    
    I see I have to make myself a little more clear.  Unfortunately because of
    specification restraints I must rely on generating a unique, unpredictable
    number on ANY operating system and I cannot expect the user to install 3rd
    party randomizers hardware or software (such as Yarrow, though it looks
    good).
    
    1) It must be written in PHP but because of the features I need I can't use
    its built in session handler.
    2) I cannot rely on /dev/urandom because windows does not support that.
    3) Microtime() returns time() + microseconds since last second
    4) The MD5 is for mangling of the data just so it is harder to guess also
    serves as a convenient way of ensureing safe passing via browser.
    
    Based on these constraints, is there a good way of doing this?  I could use
    a built in PHP function called UniqID, but it seems to only be md5(rand())
    
    
    Ryan
    



    This archive was generated by hypermail 2b30 : Fri Jan 11 2002 - 12:19:12 PST