Tiqr / tiqr-server-libphp

A PHP library for using the tiqr authentication mechanism
6 stars 7 forks source link

Replace custom random generation with PHP random_bytes() #23

Closed pmeulen closed 2 years ago

pmeulen commented 2 years ago

Replace custom random number generation code with one implementation that uses random_bytes() Require PHP >= 7.0 for random_bytes() random_bytes() uses getrandom() on linux

Note: Although unlikely random_bytes() can throw, which means that tiqr-server-libphp functions that previously did not throw can now thow an exception. I think this is better than e.g. the silent fallback to the non cryptogrphically secure mt_rand()