Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:104954
MIME-Version: 1.0
References: <CAESVnVpohz_i+NddFetU9LxrBh=d7FpnK6f=suXgKjUtBwDVqg@mail.gmail.com>
In-Reply-To: <CAESVnVpohz_i+NddFetU9LxrBh=d7FpnK6f=suXgKjUtBwDVqg@mail.gmail.com>
Reply-To: bishop@php.net
Date: Mon, 25 Mar 2019 23:08:06 -0400
Message-ID: <CAEYWF=60sZ9ZB7=pCyNkSNsuuzJi1qBUPw1YnXsWfk_9+w=4Sg@mail.gmail.com>
To: Sara Golemon <pollita@php.net>
Cc: PHP internals <internals@lists.php.net>
Content-Type: multipart/alternative; boundary="000000000000d7aec80584f6a2cc"
Subject: Re: [PHP-DEV] Argon2 default time cost
From: bishop@php.net (Bishop Bettini)

--000000000000d7aec80584f6a2cc
Content-Type: text/plain; charset="UTF-8"

On Mon, Mar 25, 2019 at 10:18 PM Sara Golemon <pollita@php.net> wrote:

> ...snip...
> So that's a long winded way of asking, does anyone see an issue with upping
> the default time cost for argon2 to a higher number? (e.g. "3")
> ...snip...
> The only negative impact is that password hashing becomes a slightly more
> expensive task.  Where "slightly" means 3ms instead of 2ms on my Linux VM
> running on my 2 core Mac laptop.
>

Thanks for tackling this work, Sara. As has been said, "whatever cost
people choose should be reevaluated from time to time." [1] Now's as good a
time as any. I have no objection.

bishop

[1]:
https://www.usenix.org/legacy/publications/library/proceedings/usenix99/provos/provos_html/node6.html

--000000000000d7aec80584f6a2cc--