• caglararli@hotmail.com
  • 05386281520

Is PHP’s mt_rand function insecure on every platform?

Çağlar Arlı      -    43 Views

Is PHP’s mt_rand function insecure on every platform?

I was going through this article, https://www.ambionics.io/blog/php-mt-rand-prediction, which claims that if we use mt_rand(), we can get the seed value using two values instead of brute forcing.

In the article it says:

The first step in generating random numbers using mt_rand() is to use a seed, an unsigned int, to generate a state array of 624 values. This is done by either calling mt_srand($seed) or automatically, by PHP, upon requesting the first random number. After this, each call to mt_rand() will take the next state value, scramble it, and return it to the user.

My question: Is the mt_rand() completely insecure or it is platform dependent as well? For example when I will do mt_rand(), the seeding state array of 624 values that will be created in my computer is different. If Person B does mt_rand() with same seeding value the output state will be different. How come than we both get the same random number?