sarciszewski · February 16, 2016 22:49 · Mar 2, 2015 · Mar 1, 2015 · Mar 1, 2015 · Mar 1, 2015
diff --git a/functions.php b/functions.php
@@ -14,3 +14,12 @@ function better_prng($bytes = 32)
    }
    return openssl_random_pseudo_bytes(32);
 }
+
+function openssl_prng($bytes = 32)
+{
+   return openssl_random_pseudo_bytes(32);
+}
+function mcrypt_prng($bytes = 32)
+{
+   return mcrypt_create_iv(32, MCRYPT_DEV_URANDOM);
+}
diff --git a/test.php b/test.php
@@ -15,4 +15,16 @@
 }
 $tests['csprng'] = ( microtime(true) - $start ); 
 
+$start = microtime(true);
+for ($i = 0; $i < 100000; ++$i) {
+        $buf = openssl_prng();
+}
+$tests['openssl'] = ( microtime(true) - $start ); 
+
+$start = microtime(true);
+for ($i = 0; $i < 100000; ++$i) {
+        $buf = mcrypt_prng();
+}
+$tests['mcrypt'] = ( microtime(true) - $start ); 
+
 var_dump($tests);
diff --git a/test_results b/test_results
@@ -1,18 +1,40 @@
-array(2) {
+array(4) {
   ["mtrand"]=>
-  float(0.97707104682922)
+  float(2.3792960643768)
   ["csprng"]=>
-  float(0.51490783691406)
+  float(1.0584290027618)
+  ["openssl"]=>
+  float(0.38547611236572)
+  ["mcrypt"]=>
+  float(0.97102904319763)
 }
-array(2) {
+array(4) {
   ["mtrand"]=>
-  float(0.98253417015076)
+  float(2.4055750370026)
   ["csprng"]=>
-  float(0.50583696365356)
+  float(1.0631558895111)
+  ["openssl"]=>
+  float(0.30554485321045)
+  ["mcrypt"]=>
+  float(1.106586933136)
 }
-array(2) {
+array(4) {
   ["mtrand"]=>
-  float(1.0016939640045)
+  float(2.3207230567932)
   ["csprng"]=>
-  float(0.5266740322113)
+  float(1.0591180324554)
+  ["openssl"]=>
+  float(0.29997992515564)
+  ["mcrypt"]=>
+  float(1.0387818813324)
+}
+array(4) {
+  ["mtrand"]=>
+  float(2.3104860782623)
+  ["csprng"]=>
+  float(1.1197648048401)
+  ["openssl"]=>
+  float(0.2982759475708)
+  ["mcrypt"]=>
+  float(1.0270299911499)
 }
diff --git a/README.md b/README.md
@@ -1,3 +1,5 @@
 In response to some people claiming that using a CSPRNG is "going way overboard" and/or is "overkill", I've written this test to verify the performance impact of using a CSPRNG versus their insecure `mt_rand()` based hacks.
 
-I think the results are conclusive (at least on my device): A 50% speed increase. In addition to less-predictable randomness.
+I think the results are conclusive (at least on my device): A 50% speed increase. In addition to less-predictable randomness.
+
+If anyone would like to suggest a benchmark script (or conditions that lead to different results with mine), let me know and I will link to them here.
diff --git a/README.md b/README.md
@@ -0,0 +1,3 @@
+In response to some people claiming that using a CSPRNG is "going way overboard" and/or is "overkill", I've written this test to verify the performance impact of using a CSPRNG versus their insecure `mt_rand()` based hacks.
+
+I think the results are conclusive (at least on my device): A 50% speed increase. In addition to less-predictable randomness.
diff --git a/Results → test_results b/Results → test_results
diff --git a/Results b/Results
@@ -1,12 +1,18 @@
 array(2) {
-  [0]=>
-  float(0.98936986923218)
-  [1]=>
-  float(0.51176810264587)
+  ["mtrand"]=>
+  float(0.97707104682922)
+  ["csprng"]=>
+  float(0.51490783691406)
 }
 array(2) {
-  [0]=>
-  float(0.98116898536682)
-  [1]=>
-  float(0.52457714080811)
+  ["mtrand"]=>
+  float(0.98253417015076)
+  ["csprng"]=>
+  float(0.50583696365356)
+}
+array(2) {
+  ["mtrand"]=>
+  float(1.0016939640045)
+  ["csprng"]=>
+  float(0.5266740322113)
 }
diff --git a/test.php b/test.php
@@ -7,12 +7,12 @@
 for ($i = 0; $i < 100000; ++$i) {
         $buf = shitty_prng();
 }
-$tests[0] = ( microtime(true) - $start ); 
+$tests['mtrand'] = ( microtime(true) - $start ); 
 
 $start = microtime(true);
 for ($i = 0; $i < 100000; ++$i) {
         $buf = better_prng();
 }
-$tests[1] = ( microtime(true) - $start ); 
+$tests['csprng'] = ( microtime(true) - $start ); 
 
 var_dump($tests);
diff --git a/test.php b/test.php
@@ -2,7 +2,7 @@
 require "functions.php";
 
 $buf = '';
-$tests = [[],[]];
+$tests = [];
 $start = microtime(true);
 for ($i = 0; $i < 100000; ++$i) {
         $buf = shitty_prng();

diff --git a/Results b/Results
@@ -0,0 +1,12 @@
+array(2) {
+  [0]=>
+  float(0.98936986923218)
+  [1]=>
+  float(0.51176810264587)
+}
+array(2) {
+  [0]=>
+  float(0.98116898536682)
+  [1]=>
+  float(0.52457714080811)
+}
diff --git a/functions.php b/functions.php
@@ -0,0 +1,16 @@
+<?php
+function shitty_prng($bytes = 32)
+{
+   $buf = '';
+   for ($i = 0; $i < $bytes; ++$i) {
+      $buf .= chr(mt_rand(0, 255));
+   }
+}
+
+function better_prng($bytes = 32)
+{
+   if (function_exists('mcrypt_create_iv')) {
+      return mcrypt_create_iv(32, MCRYPT_DEV_URANDOM);
+   }
+   return openssl_random_pseudo_bytes(32);
+}
diff --git a/test.php b/test.php
@@ -0,0 +1,18 @@
+<?php
+require "functions.php";
+
+$buf = '';
+$tests = [[],[]];
+$start = microtime(true);
+for ($i = 0; $i < 100000; ++$i) {
+        $buf = shitty_prng();
+}
+$tests[0] = ( microtime(true) - $start ); 
+
+$start = microtime(true);
+for ($i = 0; $i < 100000; ++$i) {
+        $buf = better_prng();
+}
+$tests[1] = ( microtime(true) - $start ); 
+
+var_dump($tests);
Original file line number	Diff line number	Diff line change
		@@ -0,0 +1,3 @@
		In response to some people claiming that using a CSPRNG is "going way overboard" and/or is "overkill", I've written this test to verify the performance impact of using a CSPRNG versus their insecure `mt_rand()` based hacks.

		I think the results are conclusive (at least on my device): A 50% speed increase. In addition to less-predictable randomness.
No results found