Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:113007
MIME-Version: 1.0
Date: Wed, 27 Jan 2021 17:26:50 +0100
Message-ID: <CAG9XoMQQLEWQABqy+cMzCcs_EeST5AQT2XxDwuK7EXDgVSQb0A@mail.gmail.com>
To: PHP Internals <internals@lists.php.net>
Content-Type: multipart/alternative; boundary="000000000000aa9aba05b9e43d13"
Subject: password_verify() and unknown algos
From: benjamin.morel@gmail.com (Benjamin Morel)

--000000000000aa9aba05b9e43d13
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

Hi internals,

I just spent some time debugging an authentication issue after upgrading
PHP, and realized that it was due to ext-sodium not being installed, so
password_verify() would always return false for argon2i hashes.

Digging a bit more, I realized that password_verify() does not complain if
the algorithm is unknown, or if the hash string is malformed:

    var_export(password_verify('passw0rd', 'any/string%as|a$hash')); //
false

Shouldn't it throw an exception, or a least trigger a warning, when the
algorithm is unknown, or the hash is malformed? Returning false IMO, should
mean "I recognize this hash, but it doesn't match your password". "I don't
recognize this hash" is an application issue and should be reported.

What do you think?

=E2=80=94 Benjamin

--000000000000aa9aba05b9e43d13--