Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:117096
MIME-Version: 1.0
References: <5983302.2649742.1645319015766@email.ionos.com>
 <6238bf00-011e-35cc-d84b-4082b4f05099@gmail.com> <497325306.1564942.1645357444018@email.ionos.com>
 <3c6871ca-589d-6812-800c-a3b9ad6bb575@bastelstu.be> <CADyq6sLWRfD2DJwRNWmX=s7rbA2Rs+Agu9tsW9mLQbCeJ27vwA@mail.gmail.com>
 <40015164-ac0c-336d-c7d6-c4766d6caff8@gmail.com> <CADyq6s+e_Jkwg1UoGS_e23=6FciRB2-d8q_NxkREMt45f=vs8g@mail.gmail.com>
 <b52c5f52-3295-7792-1897-c170bb132331@bastelstu.be> <CADyq6sKjgkM2z_MkYypw79E-payfVG4m7hdsbDoLTPnSJMTLhA@mail.gmail.com>
 <7527ab0b-bed1-6788-a0ff-e75672054be7@bastelstu.be> <CADyq6s+0-tWjLbMz5k-DyJ0UpQtkw5GYiUJaQsd7awGmLdRpxQ@mail.gmail.com>
In-Reply-To: <CADyq6s+0-tWjLbMz5k-DyJ0UpQtkw5GYiUJaQsd7awGmLdRpxQ@mail.gmail.com>
Date: Mon, 21 Feb 2022 12:28:28 +0000
Message-ID: <CAEKnhAF0BmuE3=+FF4EgKGTzDmpnSnOtgJAe0=Foyp5N50LEMQ@mail.gmail.com>
To: Marco Pivetta <ocramius@gmail.com>
Cc: =?UTF-8?Q?Tim_D=C3=BCsterhus?= <tim@bastelstu.be>, 
	Stanislav Malyshev <smalyshev@gmail.com>, PHP Internals List <internals@lists.php.net>
Content-Type: multipart/alternative; boundary="000000000000507c3105d8865ff4"
Subject: Re: [PHP-DEV] RFC proposal to deprecate crypt()
From: bukka@php.net (Jakub Zelenka)

--000000000000507c3105d8865ff4
Content-Type: text/plain; charset="UTF-8"

>
> As mentioned elsewhere in the mail thread, `crypt()` is not designed for
> fast hashing, and is in fact slow by design.
>

What do you mean by slow? Are you aware that  password_hash
and password_verify for bcrypt are just wrappers around crypt? Just to note
that by removing that, we would still need to keep php_crypt in the core
and would just get rid of couple of lines for the actual function
definitions and arguments so there's absolutely no benefit in terms of
maintanance.

We have got plenty of functions that are quite low level but offer some
additional functionality that can be used by specialised libraries / apps.
I think that it's much better to educate users by documentation rather than
removing the actual functionality that has got some valid users. We can see
that there are some valid use case for using crypt directly and we can also
see that it's offered by other languages as well - e.g. Python:
https://docs.python.org/3/library/crypt.html .

Jakub

--000000000000507c3105d8865ff4--