paragonie / seedspring Goto Github PK

Hello,

First of all, thanks for this great library.

I recently noticed that master contains some changes that have not been tagged yet, including the changes on composer.json#L18, which removes the restriction from PHP ^5.6.0|^7.0.0 and replaces with >= 5.6. Therefore, making it compatible with PHP8 and PHP8.1.

Would it be possible for you to release a new 1.2.0 tag containing this changes?

Thank you in advance for your consideration

When generating integers within a small range (less than 64), the nonce for the getBytes function doesn't change, thus the generation tends to fail often (since it repeatedly generates the same int, which may not be in the desired range).

Example faulty behavior:

$prng = new \ParagonIE\SeedSpring\SeedSpring('JuxJ1XLnBKk7gPAS');
$int = $prng->getInt(0,19);

PHP Fatal error: Uncaught Exception: RNG is broken - too many rejections in .../src/SeedSpring.php:176

$prng = new \ParagonIE\SeedSpring\SeedSpring('JuxJ1XLnBKk7gPAS');
$int = $prng->getInt(0,20);

PHP Fatal error: Uncaught Exception: RNG is broken - too many rejections in .../src/SeedSpring.php:176

etc.

The reason for this is the following: getNonce gets the number random bytes to be generated in the $increment parameter. It then uses this parameter to increase the internal counter the following way:

$incr = (int) \floor(($increment + ($increment % 16)) / 16);
$this->counter += $incr;

Obvously, when this parameter is $increment==1 (as it is, in the cases above), the counter doesn't get incresed ($incr == 0).

Question: what is the reasoning behind the way the counter is increased right now? Wouldn't

$this->counter+=1

be theoretically sufficient?