Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:102122
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain erianna.com designates 209.85.214.42 as permitted sender)
Date: Tue, 22 May 2018 10:51:21 -0500
To: PHP internals <internals@lists.php.net>
Message-ID: <65f56c76-a212-4185-983c-312b42210e23@Spark>
In-Reply-To: <CAGC=tRmwofyymNumRMRLP0OA5EhMaQPbfkk+OWkq9eB_Qxy_8A@mail.gmail.com>
References: <CAGC=tRmwofyymNumRMRLP0OA5EhMaQPbfkk+OWkq9eB_Qxy_8A@mail.gmail.com>
MIME-Version: 1.0
Content-Type: multipart/alternative; boundary="5b043ca0_22221a70_17e1e"
Subject: Re: [RFC][DISCUSSION] Argon2id in Password Hash
From: charlesportwoodii@erianna.com ("Charles R. Portwood II")

--5b043ca0_22221a70_17e1e
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: quoted-printable
Content-Disposition: inline

On =46eb 5, 2018, 9:43 AM -0600, Charles R. Portwood II <charlesportwoodi=
i=40erianna.com>, wrote:

> Hello Internals,
>
> I would like to propose adding Argon2id to the password=5F* functions i=
n PHP 7.3.
>
> An R=46C=5B1=5D has been prepared which covers implementation details, =
and some common questions & concerns that I have anticipated. This R=46C =
also includes a tested and working implementation=5B2=5D to illustrate ch=
anges to PHP itself.
>
> The biggest question at this time is how we want to handle versioning o=
f the Argon2 reference library. The R=46C covers this issue in detail and=
 provides a solution that ensures no BC breakage for existing users.
>
> I look forward to hearing your feedback. Thanks.
>
> =5B1=5D https://wiki.php.net/rfc/argon2=5Fpassword=5Fhash=5Fenhancement=
s
> =5B2=5D: https://github.com/php/php-src/compare/master...charlesportwoo=
dii:argon2=5Fpassword=5Fhash=5Fenhancements=3Fexpand=3D1
>
> ---
>
> Charles R. Portwood II

Hello Internals,

I would like to follow up on the R=46C to add Argon2id to the password=5F=
* functions in PHP 7.3. The discussion itself=5B1=5D didn=E2=80=99t seem =
to gather much attention since it was posted in =46ebruary, however there=
 has been some discussions=5B2=5D in a separate thread inquiring about th=
e status of Argon2 in PHP in general.

I=E2=80=99ve updated the R=46C=5B3=5D based upon discussions I=E2=80=99ve=
 had with individuals outside of the mailing list. With this update the R=
=46C now recommends forcing an libargon2 version >=3D 20161029 during con=
figure for the --with-password-argon2 flag, providing password=5F* with s=
upport for both Argon2i and Argon2id.

I would like to target PHP 7.3 with this R=46C. Since there haven=E2=80=99=
t been any major discussion points raised since the R=46C is introduced b=
ack in =46ebruary, I would like to offer another an opportunity for addit=
ional discussion before I submit this R=46C for a vote in the next few we=
eks.

I look forward to hearing your feedback=21 Thanks.

=5B1=5D:=C2=A0https://externals.io/message/101777
=5B2=5D:=C2=A0https://externals.io/message/102041=23102042
=5B3=5D:=C2=A0https://wiki.php.net/rfc/argon2=5Fpassword=5Fhash=5Fenhance=
ments

---

Charles R. Portwood II

--5b043ca0_22221a70_17e1e--