Better Random Generating PHP

Question

I know that just using rand() is predictable, if you know what you're doing, and have access to the server.

I have a project that is highly dependent upon choosing a random number that is as unpredictable as possible. So I'm looking for suggestions, either other built-in functions or user functions, that can generate a better random number.

I used this to do a little test:

$i = 0;

while($i < 10000){
    $rand = rand(0, 100);

    if(!isset($array[$rand])){
        $array[$rand] = 1;
    } else {
        $array[$rand]++;
    }

    sort($array);
    $i++;
}

I found the results to be evenly distributed, and there is an odd pattern to the number of times each number is generated.

There is a new function in php7, which does exactly what you need. — Salvador Dali
– Salvador Dali, Commented Jul 16, 2015 at 3:28

Christian Lescuyer · Accepted Answer · 2008-08-08 11:48:42Z

22

Adding, multiplying, or truncating a poor random source will give you a poor random result. See Introduction to Randomness and Random Numbers for an explanation.

You're right about PHP rand() function. See the second figure on Statistical Analysis for a striking illustration. (The first figure is striking, but it's been drawn by Scott Adams, not plotted with rand()).

One solution is to use a true random generator such as random.org. Another, if you're on Linux/BSD/etc. is to use /dev/random. If the randomness is mission critical, you will have to use a hardware random generator.

answered Aug 8, 2008 at 11:48

Christian Lescuyer

19.3k6 gold badges51 silver badges46 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

Vlad · Accepted Answer · 2015-07-16 19:14:34Z

5

random.org has an API you can access via HTTP.

RANDOM.ORG is a true random number service that generates randomness via atmospheric noise.

edited Jul 16, 2015 at 19:14

Vlad

18.8k4 gold badges44 silver badges72 bronze badges

answered Aug 8, 2008 at 12:27

Kevin

13.1k11 gold badges57 silver badges77 bronze badges

Comments

Christian Lescuyer · Accepted Answer · 2008-08-08 20:09:42Z

4

I would be wary of the impression of randomness: there have been many experiments where people would choose the less random distribution. It seems the mind is not very good at producing or estimating randomness.

There are good articles on randomness at Fourmilab, including another true random generator. Maybe you could get random data from both sites so if one is down you still have the other.

Fourmilab also provides a test program to check randomness. You could use it to check your various myRand() programs.

As for your last program, if you generate 10000 values, why don't you choose the final value amongst the 10 thousand? You restrict yourself to a subset. Also, it won't work if your $min and $max are greater than 10000.

Anyway, the randomness you need depends on your application. rand() will be OK for an online game, but not OK for cryptography (anything not thoroughly tested with statistical programs will not be suitable for cryptography anyway). You be the judge!

answered Aug 8, 2008 at 20:09

Christian Lescuyer

19.3k6 gold badges51 silver badges46 bronze badges

1 Comment

RWC Over a year ago

About the true random generator you refer to: At the end of 2022, the HotBits Radioactive Random Number Generator service will be retired.

Aaron Gong · Accepted Answer · 2013-09-18 08:59:40Z

2

Another way of getting random numbers, similar in concept to getting UUID

PHP Version 5.3 and above

openssl_random_pseudo_bytes(...)

Or you can try the following library using RFC4122

answered Sep 18, 2013 at 8:59

Aaron Gong

1,0258 silver badges18 bronze badges

Comments

Justin Yost · Accepted Answer · 2008-08-08 04:48:14Z

1

Variation on @KG, using the milliseconds since EPOCH as the seed for rand?

answered Aug 8, 2008 at 4:48

Justin Yost

2,34019 silver badges31 bronze badges

1 Comment

Piskvor left the building Over a year ago

Sooooo, with today's fast multi-core computers, you have a pretty solid chance of re-using the seed, multiple times? Humongous red flag - you're reinventing a square wheel, even srand() with no arguments does a better ("more random") job.

Community · Accepted Answer · 2017-05-23 12:09:14Z

1

A new PHP7 there is a function that does exactly what you needed: it generates cryptographically secure pseudo-random integers.

int random_int ( int $min , int $max )

Generates cryptographic random integers that are suitable for use where unbiased results are critical (i.e. shuffling a Poker deck).

For a more detailed explanation about PRNG and CSPRNG (and their difference) as well as why your original approach is actually a bad idea, please read my another highly similar answer.

edited May 23, 2017 at 12:09

CommunityBot

11 silver badge

answered Jul 16, 2015 at 3:27

Salvador Dali

224k151 gold badges728 silver badges766 bronze badges

Collectives™ on Stack Overflow

Better Random Generating PHP

6 Answers 6

Comments

Comments

1 Comment

Comments

1 Comment

Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

6 Answers 6

Comments

Comments

1 Comment

Comments

1 Comment

Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related