Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:108443
MIME-Version: 1.0
References: <CAN+C6bVeO4nU_3egiwhM0MML9NUJJB4oYgWVUo_bhJRPKUVpPQ@mail.gmail.com>
 <CADbOR2i3Jq25rVPwvYtRN=mJ+rrJH40LhyvzpBx89t1tob6_Ag@mail.gmail.com>
In-Reply-To: <CADbOR2i3Jq25rVPwvYtRN=mJ+rrJH40LhyvzpBx89t1tob6_Ag@mail.gmail.com>
Reply-To: Tom Van Looy <tom@ctors.net>
Date: Mon, 10 Feb 2020 22:56:35 +0100
Message-ID: <CAN+C6bVbQ4c4hePaikyppirmb9R5y3-NFx_JZFNABvhqOoTPEA@mail.gmail.com>
To: j adams <zardozrocks@gmail.com>
Cc: PHP internals <internals@lists.php.net>
Content-Type: multipart/alternative; boundary="000000000000c600a6059e3fd02c"
Subject: Re: [PHP-DEV] [RFC] deprecate md5_file and sha1_file
From: internals@lists.php.net ("Tom Van Looy via internals")

--000000000000c600a6059e3fd02c
Content-Type: text/plain; charset="UTF-8"

the hash_file() function still supports md5 and sha1 so people that need it
should then migrate to hash_file('md5', ...) or hash_file('sha1', ...)
instead. That was the idea

Kind regards,

Tom

On Mon, Feb 10, 2020 at 10:52 PM j adams <zardozrocks@gmail.com> wrote:

> I disagree. While MD5 and SHA1 might not be suitable for modern
> cryptographic operations, these functions might be needed for legacy
> situations -- e.g., munging through old data.
>
>
> On Mon, Feb 10, 2020 at 1:50 PM Tom Van Looy via internals <
> internals@lists.php.net> wrote:
>
>> Hi
>>
>> While in some environments the use of MD5 and SHA1 are still acceptable
>> for
>> some use cases like file integrity verification etc. the use of these
>> algorithms should be discouraged and not be your choice when developing
>> new
>> applications.
>>
>> I suggest to deprecated the functions md5_file() and sha1_file(). This
>> will
>> make people think about upgrading to a better alternative. If you still
>> need this functionality you can always switch to the hash_file() function.
>>
>> Carrying around these two dedicated functions seems a bit too much for a
>> modern PHP. What do you think?
>>
>> My feeling was that this is a no brainer. Should I open an RFC for this?
>>
>> Kind regards,
>>
>> Tom Van Looy
>>
>

--000000000000c600a6059e3fd02c--