PHP mt_srand no longer seeds same number!!!!! aaarrrg

[A]

Hi all.

Is this a bug or what???

here is a simple code:

<?php
mt_srand(1);
echo mt_rand(0, 255)."<br />";
echo mt_rand(0, 255)."<br />";
echo mt_rand(0, 255)."<br />";
echo mt_rand(0, 255)."<br />";
?>

It should produce the SAME sequence every time when run.

however... it does not on PHP 5.2.6 on the linux box.

But on my test environment (windows) - php 5.2.3 does work properly!

So what am I missing? How do I get the same random sequences based on
mt_rand and mt_srand? I need same sequences based on starting seed!

I looked at the docs and it says:

The Mersenne Twister implementation in PHP now uses a new seeding
algorithm by Richard Wagner.
Identical seeds no longer produce the same sequence of values they did
in previous versions.
This behavior is not expected to change again, but it is considered
unsafe to rely upon it nonetheless.
but it says - AFTER 5.2.1 --- and I have both versions ABOVE 5.2.1...what to
do? ideas? pleeeeeeaseeeee eee! :)

[WalterGR]

On Sep 12, 4:39*am, Jerry Stuckle <jstuck...@attg lobal.netwrote:

And a "repeatable sequence of random numbers" is an oxymoron. *Yes, many
people have used a random number generator as a quick way to generate a
repeatable sequence. *I consider THAT a bug.

That's only because people are using the terminology colloquially.
What they mean is a "repeatable sequence of numbers which are
statistically random." It's entirely expected behavior that when
using the same seed one will get that. Especially if that's the
behavior of previous versions of the system.

However, http://www.php.net/manual/en/function.mt-srand.php does
state:

"Since 5.2.1 the Mersenne Twister implementation in PHP now uses a new
seeding algorithm by Richard Wagner. Identical seeds no longer produce
the same sequence of values they did in previous versions. This
behavior is not expected to change again, but it is considered unsafe
to rely upon it nonetheless."

The last sentence is quite important.

Walter

[A]

"Since 5.2.1 the Mersenne Twister implementation in PHP now uses a new
seeding algorithm by Richard Wagner. Identical seeds no longer produce
the same sequence of values they did in previous versions. This
behavior is not expected to change again, but it is considered unsafe
to rely upon it nonetheless."

I found somewhere on some forum that this is misstated. What this means is
that 5.2.0 and 5.2.1 will not produce the same sequence for the same seed,
however, the same seed will produce the same seq on specific php version in
other words, the sequences are not likely to change on future versions on
php e.g. 5.2.3, 5.2.6, 6.0 etc. but the seed will still function as it used
to.

anyway - the issue was somehow server related and not php related - the
administrator now fixed this script:

srand(42);
for ($i = 3; $i--;) echo rand()."<br />";
but my old one:

srand(1);
echo rand(0, 255)."<br />";
echo rand(0, 255)."<br />";
echo rand(0, 255)."<br />";

still produces random numbered sequences like srand is commented out. i'll
see if he can check that one out as well. i'll also ask him what was the
cause of this misbehaviour - maybe it is something to do with apache?

[A]

ok, here is the deal what happened here:

it appears that the latest build of suhosin module has an option to ignore
srand and mt_srand seeds and seed automatically. and the server php was
built with that option. where i used prebuilt module which obviously has
this option differently configured.

anyway, if anyone has an issue with that, now you know.

[Jerry Stuckle]

WalterGR wrote:

On Sep 12, 4:39 am, Jerry Stuckle <jstuck...@attg lobal.netwrote:

>And a "repeatable sequence of random numbers" is an oxymoron. Yes, many
people have used a random number generator as a quick way to generate a
repeatable sequence. I consider THAT a bug.

That's only because people are using the terminology colloquially.
What they mean is a "repeatable sequence of numbers which are
statistically random." It's entirely expected behavior that when
using the same seed one will get that. Especially if that's the
behavior of previous versions of the system.

However, http://www.php.net/manual/en/function.mt-srand.php does
state:

"Since 5.2.1 the Mersenne Twister implementation in PHP now uses a new
seeding algorithm by Richard Wagner. Identical seeds no longer produce
the same sequence of values they did in previous versions. This
behavior is not expected to change again, but it is considered unsafe
to rely upon it nonetheless."

The last sentence is quite important.

Walter

They use it only because they've become accustomed to it being a
repeatable sequence. Such an assumption is incorrect.

PHP's implementation is now much closer to a true random number generator.

--
=============== ===
Remove the "x" from my email address
Jerry Stuckle
JDS Computer Training Corp.
js*******@attgl obal.net
=============== ===

[Gordon Burditt]

>PHP's implementation is now much closer to a true random number generator.

PHP's implementation is much closer to a live goat than it is to a
true random number generator. So is any other pseudo-random number
generator.

It's a *PSEUDO*-random number generator, and if you use cryptography,
the difference between a true random number generator and a
pseudo-random number generator can get you executed as a spy.

[Jerry Stuckle]

Gordon Burditt wrote:

>PHP's implementation is now much closer to a true random number generator.

PHP's implementation is much closer to a live goat than it is to a
true random number generator. So is any other pseudo-random number
generator.

It's a *PSEUDO*-random number generator, and if you use cryptography,
the difference between a true random number generator and a
pseudo-random number generator can get you executed as a spy.

When it comes to random number generators, NO language provides a real
one. They are all pseudo-random.

So you're saying anyone who uses cryptography on a computer should be
executed as a spy.

The world would be a very lonely place...

--
=============== ===
Remove the "x" from my email address
Jerry Stuckle
JDS Computer Training Corp.
js*******@attgl obal.net
=============== ===

[Twayne]

On Sep 12, 4:39 am, Jerry Stuckle <jstuck...@attg lobal.netwrote:

>

>And a "repeatable sequence of random numbers" is an oxymoron. Yes,
many people have used a random number generator as a quick way to
generate a repeatable sequence. I consider THAT a bug.

That's only because people are using the terminology colloquially.
What they mean is a "repeatable sequence of numbers which are
statistically random." It's entirely expected behavior that when
using the same seed one will get that. Especially if that's the
behavior of previous versions of the system.

umm, no, not unless that was the design goal, which I don't think it was
or it wouldn't have been "fixed". Random is random is ... . A
randomizer that regenerates the same numbers is not creating truly
random numbers, is it?

>
However, http://www.php.net/manual/en/function.mt-srand.php does
state:

"Since 5.2.1 the Mersenne Twister implementation in PHP now uses a new
seeding algorithm by Richard Wagner. Identical seeds no longer produce
the same sequence of values they did in previous versions. This
behavior is not expected to change again, but it is considered unsafe
to rely upon it nonetheless."

The last sentence is quite important.

Sounds more like a weasel-out statement to me, admitting that the "fix'
might be a little iffy.

>
Walter

[Michael Fesser]

..oO(Jerry Stuckle)

>Gordon Burditt wrote:

>>PHP's implementation is now much closer to a true random number generator.

PHP's implementation is much closer to a live goat than it is to a
true random number generator. So is any other pseudo-random number
generator.

It's a *PSEUDO*-random number generator, and if you use cryptography,
the difference between a true random number generator and a
pseudo-random number generator can get you executed as a spy.

When it comes to random number generators, NO language provides a real
one. They are all pseudo-random.

So you're saying anyone who uses cryptography on a computer should be
executed as a spy.

The world would be a very lonely place...

No more problems finding a parking space. ;)

Micha

[Michael Fesser]

..oO(Twayne)

>On Sep 12, 4:39 am, Jerry Stuckle <jstuck...@attg lobal.netwrote:

>>And a "repeatable sequence of random numbers" is an oxymoron. Yes,
many people have used a random number generator as a quick way to
generate a repeatable sequence. I consider THAT a bug.

That's only because people are using the terminology colloquially.
What they mean is a "repeatable sequence of numbers which are
statisticall y random." It's entirely expected behavior that when
using the same seed one will get that. Especially if that's the
behavior of previous versions of the system.

umm, no, not unless that was the design goal, which I don't think it was
or it wouldn't have been "fixed".

If it would have been a design mistake, then there wouldn't be a seed
function. But it exists, hence the previous behaviour was by intention.

>Random is random is ... . A
randomizer that regenerates the same numbers is not creating truly
random numbers, is it?

Truly random numbers require some more effort and can't be created with
software alone.

A software-based generator only creates pseudo-random numbers, based on
algorithms. Such algorithms are usually deterministic - same input, same
output.

Micha

[Gordon Burditt]

>When it comes to random number generators, NO language provides a real

>one. They are all pseudo-random.

That's not an excuse to call any of them a true random number generator.

There are some hardware devices intended to generate random numbers
based on quantum theory (some built into Intel CPUs, for example).
Some operating systems give access to this, some through /dev/random.
Are there no languages that use the OS /dev/random?

>So you're saying anyone who uses cryptography on a computer should be
executed as a spy.

No, I'm saying that if they use crappy cryptography, they are more
likely to be CAUGHT and CONVICTED as a spy because their cryptography
is crappy.