search

RobThree / TwoFactorAuth

PHP library for Two Factor Authentication (TFA / 2FA)
MIT License
1.07k stars 126 forks source link

remove insecure rng providers #122

Closed NicolasCARPi closed 5 months ago

NicolasCARPi commented 5 months ago

and remove the openssl provider. We now rely exclusively on random_bytes(), as there are no reasons not to. Fix #121

NicolasCARPi commented 5 months ago

I cleaned up the tests, too. The TestRngProvider class inside test was tested, but there is no point to test a class that we have in tests. Tests should test the prod code, here it was doing nothing of the sort.

NicolasCARPi commented 5 months ago

Maybe the last commit was a bit too hasteful. Reverted for now.

RobThree commented 5 months ago

Isn't (or wasn't) it used to test if the 2FA class checked correctly for the isCryptographicallySecure property (or something along those lines).

NicolasCARPi commented 5 months ago

Yeah, looking at it again, and given that getRandomBytes() is simply an alias to random_bytes(), it's a bit pointless to test if f(x) == f(x). We call it once in the test suite, that's enough. Should I reverse the reverse commit then?

RobThree commented 5 months ago

I think it's safe to throw it out, since the isCryptographicallySecure check is no longer performed by the TwoFactorAuth class and it has no use anymore.

NicolasCARPi commented 5 months ago

Done.