{"record":{"id":"a25ee46aedc323c4","repo":"paragonie/random_compat","slug":"could-not-gather-sufficient-random-data","errorCode":null,"errorMessage":"Could not gather sufficient random data","messagePattern":"Could not gather sufficient random data","errorType":"exception","errorClass":"Exception","httpStatus":null,"severity":"critical","filePath":"lib/random_bytes_com_dotnet.php","lineNumber":87,"sourceCode":"        /**\n         * Let's not let it loop forever. If we run N times and fail to\n         * get N bytes of random data, then CAPICOM has failed us.\n         */\n        do {\n            $buf .= base64_decode((string) $util->GetRandom($bytes, 0));\n            if (RandomCompat_strlen($buf) >= $bytes) {\n                /**\n                 * Return our random entropy buffer here:\n                 */\n                return (string) RandomCompat_substr($buf, 0, $bytes);\n            }\n            ++$execCount;\n        } while ($execCount < $bytes);\n\n        /**\n         * If we reach here, PHP has failed us.\n         */\n        throw new Exception(\n            'Could not gather sufficient random data'\n        );\n    }\n}\n","sourceCodeStart":69,"sourceCodeEnd":92,"githubUrl":"https://github.com/paragonie/random_compat/blob/b5d188cc9d5e02f94d2c41da23093f1ef557c5b1/lib/random_bytes_com_dotnet.php#L69-L92","documentation":"After repeatedly attempting to fetch random data via CAPICOM's Utilities.GetRandom() (looping while $execCount < $bytes), the library gives up and throws. It signals that PHP on this system could not produce enough CSPRNG output through the COM backend — a last-resort failure because returning less data or weak data is never acceptable.","triggerScenarios":"The do/while loop calling $util->GetRandom() throws or returns unusable data on every iteration until $execCount reaches $bytes; CAPICOM.Utilities.1 not installed/registered on Windows; COM call failures swallowed and retried until exhaustion.","commonSituations":"Windows Server where CAPICOM is not installed (it is a legacy redistributable not present on modern Windows); 64-bit PHP where the 32-bit CAPICOM COM object cannot be instantiated; restricted COM permissions for the IIS application-pool identity.","solutions":["Verify CAPICOM (CAPICOM.Utilities.1) is installed and registered (regsvr32 capicom.dll) — or accept CAPICOM is EOL and switch backends.","Upgrade PHP to >= 7.0 so native random_bytes() is used and random_compat's COM path is skipped.","Use a random_compat build backed by mcrypt/openssl or /dev/urandom instead of the COM backend.","Check COM instantiation and permissions for the executing user (IIS app pool, service account) and test new COM('CAPICOM.Utilities.1') directly."],"exampleFix":"// before\n$bytes = random_bytes(32); // relies on CAPICOM COM backend\n// after\ntry {\n    $bytes = random_bytes(32);\n} catch (Exception $e) {\n    throw new RuntimeException('CSPRNG unavailable: ' . $e->getMessage(), 0, $e);\n}\n// Preferred long-term fix: run PHP >= 7.0 so native random_bytes() is used.","handlingStrategy":"try-catch","validationCode":"// No pre-call validation can prevent this; detect backend health instead:\ntry {\n    $probe = random_bytes(1);\n} catch (Exception $e) {\n    throw new RuntimeException('CSPRNG backend unhealthy: ' . $e->getMessage(), 0, $e);\n}","typeGuard":null,"tryCatchPattern":"try {\n    $bytes = random_bytes(32);\n} catch (Exception $e) {\n    // Never fall back to non-CSPRNG sources; fail closed and alert\n    throw new RuntimeException('Could not generate secure random data', 0, $e);\n}","preventionTips":["Install/verify CAPICOM on legacy Windows, or move off the EOL CAPICOM backend.","Upgrade to PHP >= 7.0 for native random_bytes(); delete random_compat when possible.","Fail closed: never substitute rand()/mt_rand() when CSPRNG fails.","Monitor/alert on repeated CSPRNG exceptions — they indicate systemic environment problems."],"tags":["php","environment","windows","csprng","entropy"],"backgroundTag":"environment-misconfiguration","analyzedSha":"b5d188cc9d5e02f94d2c41da23093f1ef557c5b1","analyzedAt":"2026-09-13T16:12:09.755Z","contentChangedAt":"2026-09-13T16:12:09.755Z","schemaVersion":2},"datasetVersion":"2026-09-16T04:17:20.429Z"}