Note: I have been asked to log all the security issues that I have found by an OWASP contributor to support the decision to abandon this project. My personal opinion is that all of the code in this repository is beyond repair and that it is not wise to attempt to fix it.
The fallback CSPRNG (which is actually the main CSPRNG due to https://github.com/OWASP/phpsec/issues/113) generates random numbers with a ridiculously high number of collisions.
Even if this fallback isn't attempting to be a CSPRNG the concepts shouldn't be confused. Either users need a cryptographically secure random number or they need an error.
Note: I have been asked to log all the security issues that I have found by an OWASP contributor to support the decision to abandon this project. My personal opinion is that all of the code in this repository is beyond repair and that it is not wise to attempt to fix it.
The fallback CSPRNG (which is actually the main CSPRNG due to https://github.com/OWASP/phpsec/issues/113) generates random numbers with a ridiculously high number of collisions.
https://3v4l.org/hhg3G
Even if this fallback isn't attempting to be a CSPRNG the concepts shouldn't be confused. Either users need a cryptographically secure random number or they need an error.