PHP何时会为mt_rand（）生成种子

Question

will PHP generate the seed (that is used in mt_rand()) when the server will be restarted? Where does PHP store this value?

I just found out that mt_rand() is not safe, and try to create a proof of concept for it.

Thank you very much!

Answer 1

mt_rand() is automatically seeded the first time it is used within a request , with a seed that is based on the PID, the current timestamp, and PHP's internal LCG (Linear Congruent Generator).... you can override this at any point in script execution using mt_srand() to reseed using your own seed.

Note that mt_rand() is not considered suitable for cryptographic applications, as stated in the PHP Docs . If you want crypto-strength randomness, use a documented crypto-strength generator.

Answer 2

I just found out that mt_rand() is not safe, and try to create a proof of concept for it.

See php_mt_seed by OpenWall.

If you want an alternative:

• PHP 7: random_int()
• PHP 5: random_compat
• PHP 4: Abandon all hope, ye who enter here in 2015.