{"record":{"id":"0e56026729ecb5cf","repo":"phalcon/cphalcon","slug":"cannot-calculate-random-pseudo-bytes","errorCode":null,"errorMessage":"Cannot calculate Random Pseudo Bytes","messagePattern":"Cannot calculate Random Pseudo Bytes","errorType":"exception","errorClass":"RandomBytesGenerationFailed","httpStatus":null,"severity":"error","filePath":"phalcon/Encryption/Crypt.zep","lineNumber":351,"sourceCode":"            let encryptKey = key;\n        }\n\n        if true === empty(encryptKey) {\n            throw new EmptyEncryptionKey();\n        }\n\n        let cipher   = this->cipher,\n            ivLength = this->ivLength;\n\n        this->checkCipherHashIsAvailable(cipher, \"cipher\");\n\n        let mode      = this->getMode(),\n            blockSize = this->getBlockSize(mode);\n\n        try {\n            let iv = this->phpOpensslRandomPseudoBytes(ivLength);\n        } catch \\Throwable {\n            throw new RandomBytesGenerationFailed();\n        }\n\n        let padded = this->encryptGetPadded(mode, input, blockSize);\n\n        /**\n         * If the mode is \"gcm\" or \"ccm\" and auth data has been passed call it\n         * with that data\n         */\n        let encrypted = this->encryptGcmCcm(mode, padded, encryptKey, iv);\n\n        if true === this->useSigning {\n            let digest = this->phpHashHmac(\n                this->getHashAlgorithm(),\n                padded,\n                encryptKey,\n                true\n            );\n","sourceCodeStart":333,"sourceCodeEnd":369,"githubUrl":"https://github.com/phalcon/cphalcon/blob/b7419de9cd0a8a3f48441ead84c9f8415d463e25/phalcon/Encryption/Crypt.zep#L333-L369","documentation":"Crypt::encrypt() obtains its IV by calling openssl_random_pseudo_bytes($ivLength) inside a try block; any Throwable escaping that call is swallowed and rethrown as RandomBytesGenerationFailed. This is an environment-level failure of the OS/openssl CSPRNG, not a problem with your data or key.","triggerScenarios":"openssl_random_pseudo_bytes() throwing or returning failure because: the openssl extension is loaded but broken/mismatched with the PHP version; the system entropy source is unavailable (chroot, restricted container, some minimal Docker images); OpenSSL FIPS/self-test failures; or rare older PHP bugs on exotic platforms.","commonSituations":"Heavily minimized container images (alpine variants missing proper openssl config), chrooted PHP-FPM without /dev/urandom access, or a PHP/OpenSSL ABI mismatch after partial package upgrades. Persistent occurrence usually indicates a broken PHP installation.","solutions":["Verify the CSPRNG works in that exact environment: php -r 'var_dump(bin2hex(random_bytes(16)));' and the same for openssl_random_pseudo_bytes(16).","If the container restricts devices, ensure /dev/urandom is available/mounted (check docker run device rules, seccomp profiles).","Reinstall/align the php-openssl and libssl packages (same repository/version series) - a mismatched build is the usual culprit.","As a code-level workaround you cannot inject the IV into Crypt, so fixing the runtime is the only real option; validate environment in a health check."],"exampleFix":"// before (env is broken, no code fix applies)\n$token = $crypt->encrypt($payload); // RandomBytesGenerationFailed\n\n// after: add a boot diagnostic so the real fault is visible\n$ivOk = @openssl_random_pseudo_bytes(16);\nif ($ivOk === false) {\n    throw new \\RuntimeException('openssl CSPRNG unavailable - check /dev/urandom and php-openssl');\n}\n$token = $crypt->encrypt($payload);","handlingStrategy":"try-catch","validationCode":"// Probe the CSPRNG in the target environment before relying on Crypt:\nif (false === @openssl_random_pseudo_bytes(16)) {\n    throw new \\RuntimeException('openssl CSPRNG unavailable - fix runtime (check /dev/urandom, php-openssl)');\n}","typeGuard":null,"tryCatchPattern":"try {\n    $token = $crypt->encrypt($payload);\n} catch (\\Phalcon\\Encryption\\Crypt\\Exception\\RandomBytesGenerationFailed $e) {\n    // environment failure: fail the request loudly, alert ops - do not retry in-process\n    $logger->critical('CSPRNG failure on host ' . gethostname());\n    throw new \\RuntimeException('Secure random unavailable', 0, $e);\n}","preventionTips":["Include an openssl_random_pseudo_bytes probe in container health checks.","Build images from mainstream bases with matching php/libssl packages.","Treat recurrence as an ops incident (entropy/device access), not an application bug."],"tags":["phalcon","crypt","openssl","random","environment","containers","iv"],"backgroundTag":"secure-random-generation-failed","analyzedSha":"b7419de9cd0a8a3f48441ead84c9f8415d463e25","analyzedAt":"2026-08-21T06:21:18.811Z","schemaVersion":2},"datasetVersion":"2026-08-21T11:28:35.574Z"}