Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:103329
MIME-Version: 1.0
References: <CAESVnVq-oQreEyNDQZPWJ+fxuXs_66WWBTywRii7AFEFjqxBNQ@mail.gmail.com>
 <CALKiJKrhB9pKtdF=PdBwrJB-81QLCGtr1TKF6rQ0p8XtGhFrrA@mail.gmail.com>
 <CAESVnVpXjvR2-3n6AdSA+TwzsGEEeAD0L2dH18wiDtHnwE7uHA@mail.gmail.com>
 <CALKiJKqxgFd=fQvapDrX3tJLtuEkEXk-qHwv=XrNfM5OURROHg@mail.gmail.com>
 <CAESVnVq6xDk1CmVvHNCcxyLQMmDz3CnqGBvNDJDdZYzTaVZJvQ@mail.gmail.com> <CALKiJKqcQxFYD883UvAmt=n+HvXTehDPjJcp_G1DQ2GFtRC_kw@mail.gmail.com>
In-Reply-To: <CALKiJKqcQxFYD883UvAmt=n+HvXTehDPjJcp_G1DQ2GFtRC_kw@mail.gmail.com>
Date: Thu, 18 Oct 2018 09:18:34 -0500
Message-ID: <CAESVnVq5qsKgd1CCoTyEWtD6xCdaBMoTsW8Ty=bu-_Bp1cNGng@mail.gmail.com>
To: Rowan Collins <rowan.collins@gmail.com>
Cc: PHP internals <internals@lists.php.net>
Content-Type: text/plain; charset="UTF-8"
Subject: Re: [PHP-DEV] Password Digest Registry
From: pollita@php.net (Sara Golemon)

On Thu, Oct 18, 2018 at 9:16 AM Rowan Collins <rowan.collins@gmail.com> wrote:
> On Thu, 18 Oct 2018 at 14:55, Sara Golemon <pollita@php.net> wrote:
>> Unfortunately, I just sat down to implement it and noticed that we
>> have explicit test cases which verify that only hashes with a prefix
>> of "$2y" *and* a length of precisely 60 are identified as bcrypt.  So
>> either we need to loosen that check (I'm trying to avoid BC breaks
>> here), or we create additional identification logic.
>
> Hm... what does length != 60 currently generate - presumably it's just an "unrecognised format" error of some sort?
>
For the purposes of rehash/verify, an "unknown algorithm" is
equivalent to bcrypt as a fallback.  password_get_info() makes the
distinction, however.

> If so, we could keep BC by having a validate method in each handler, but only call it for hashes with the given prefix, and return an error if it returns false.
>
That would address this, *and* provide that more-general mechanism. +1

-Sara