The objective of this RFC is session module code cleanup, remove unneeded code complexity and redundancy.
NOTE: It is meaningless applying hash to CS safe random bytes.
Since PHP 7, there is php_random_bytes() function. Session ID generation does not need hashing for secure session ID generation. Session module may simply convert random bytes to readable characters.
As a bonus, simple session generation performance increased 2X or more.
Use php_random_bytes() generated binary random value directly and convert it to session ID by using session internal bin_to_readable() function.
Remove hash and RNG related codes and settings from session module.
Add new config for session ID generation.
Default INI setting is vote option. session.sid_length=48 and session.sid_bits_per_character=5 is stronger, but BC. session.sid_length=32 and session.sid_bits_per_character=4 is weaker, but no BC.
NOTE: New session ID is far less likely to have collisions. Even if system has broken CSPRNG, session module has session ID collision detection already.
Min/max length of session ID: 22 - 256 (22 is the same length as MD5 hash with_hash_bits_per_chars=6)
If PRNG has vulnerability that generates predictable value, exposing raw PRNG state helps attackers. Although, this is unlikely with modern PRNGs, but risk is there.
To mitigate risk, additional bytes (+60 bytes) are read from PRNG. Additional bytes should be good enough for predictable session ID with broken PRNG implementation. Those who are concerned PRNG quality, you may choose new INI defaults. Those who are comfortable with PRNG quality and value compatibility, you may choose compatible(old) INI defaults.
None, when compatible default is chosen
If non-compatible default is chosen, session.sid_length, session.sid_bits_per_character may set to compatible value.
hardcoded default and php.ini-* default values are the same. This is voting option.
3rd party and user save handlers are unaffected.
This project requires 2/3 majority.
Please select preferred default options. If number of votes are even, compatible(No BC break) options are used.
Due to the default value used in php.ini-development/production, INI settings in those files are set to
This matches session.hash_func=0 and session.hash_bits_per_character=5 used since PHP 5.3.