Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:104953
MIME-Version: 1.0
Date: Mon, 25 Mar 2019 21:17:58 -0500
Message-ID: <CAESVnVpohz_i+NddFetU9LxrBh=d7FpnK6f=suXgKjUtBwDVqg@mail.gmail.com>
To: PHP internals <internals@lists.php.net>
Content-Type: multipart/alternative; boundary="000000000000a4fcbe0584f5ee06"
Subject: Argon2 default time cost
From: pollita@php.net (Sara Golemon)

--000000000000a4fcbe0584f5ee06
Content-Type: text/plain; charset="UTF-8"

In sitting down to expose libsodium's argon2i password hashing function via
password_hash(), I discovered two things.

The first is that it doesn't seem to support Argon2id for password storage
the way we use it in password_hash().  Bummer, but that's a conversation to
have with Frank, and there's nothing we can do about it for the foreseeable
future.

The second is that crypto_pwhash_str() and crypto_pwhash_str_verify()
reject any attempt to use a "time_cost" value less than three.  Wanna guess
what our default time_cost value is?  That's right, it's two.

So that's a long winded way of asking, does anyone see an issue with upping
the default time cost for argon2 to a higher number? (e.g. "3")  This will
ensure that the following actually works as expected and doesn't give users
confusing result and more importantly, allows us to use sodium to back
argon hashing interchangeably with the more lenient libargon.

$hash = password_hash("Foo", PASSWORD_ARGON2I);
var_dump(sodium_crypto_pwhash_str_verify($hash, "Foo")); // currently
FALSE, due to t < 3.

The only negative impact is that password hashing becomes a slightly more
expensive task.  Where "slightly" means 3ms instead of 2ms on my Linux VM
running on my 2 core Mac laptop.

-Sara

--000000000000a4fcbe0584f5ee06--