Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:121004
Return-Path: <tim@bastelstu.be>
Delivered-To: mailing list internals@lists.php.net
Received: (qmail 27814 invoked from network); 7 Sep 2023 17:26:39 -0000
Received: from unknown (HELO php-smtp4.php.net) (45.112.84.5)
  by pb1.pair.com with SMTP; 7 Sep 2023 17:26:39 -0000
Received: from php-smtp4.php.net (localhost [127.0.0.1])
	by php-smtp4.php.net (Postfix) with ESMTP id 7E9B71804DF
	for <internals@lists.php.net>; Thu,  7 Sep 2023 10:26:38 -0700 (PDT)
X-Spam-Checker-Version: SpamAssassin 3.4.2 (2018-09-13) on php-smtp4.php.net
X-Spam-Level: 
X-Spam-Status: No, score=-2.1 required=5.0 tests=BAYES_00,DKIM_SIGNED,
	DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,SPF_HELO_NONE,SPF_PASS,
	T_SCC_BODY_TEXT_LINE autolearn=no autolearn_force=no version=3.4.2
X-Spam-ASN: AS24940 176.9.0.0/16
X-Spam-Virus: No
X-Envelope-From: <tim@bastelstu.be>
Received: from chrono.xqk7.com (chrono.xqk7.com [176.9.45.72])
	(using TLSv1.2 with cipher ECDHE-ECDSA-AES256-GCM-SHA384 (256/256 bits))
	(No client certificate requested)
	by php-smtp4.php.net (Postfix) with ESMTPS
	for <internals@lists.php.net>; Thu,  7 Sep 2023 10:26:37 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=bastelstu.be;
	s=mail20171119; t=1694107595;
	bh=4DdiItlYjwoYY8hWN38k1B6yyqpqmvmLs1QCgxUTEgo=;
	h=Message-ID:Date:MIME-Version:To:From:Subject:Content-Type:from:to:
	 cc:subject:message-id;
	b=TT64/0kbDLkRE1mg1CYLkNRtxkk72JaYTvLKpe5vVPdIPOXyTm9qYpXPh4NqnITpk
	 UHh+OqAxApS1A2vTwa1OZ/UE0r6LO+KXxzbEBu2fNoRpfnzk1k08xO9cb+rbEo1Dct
	 fnsCUbY4dxTw78yP0ZDBvOFOtb6opUn1JiHPNu9glXnOdS2YykkPJ6Y9i/9yXIs4/r
	 imswqqqRrcjDytHV0BUjAfDmNvfFIRRFIe4qLreAqUqI6pIpYeCFf1vthjZqq2uVxE
	 vkEYrLryMZrn0bbTWB2/Z3jUuQZD6iMrO0wU/PLdCQ8G99kA1JmyLfry1wbEN8/eJc
	 gNbETmbaY62RA==
Message-ID: <e6d0f349-436d-8545-4146-e1293c901d65@bastelstu.be>
Date: Thu, 7 Sep 2023 19:26:34 +0200
MIME-Version: 1.0
Content-Language: en-US
To: PHP internals <internals@lists.php.net>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 8bit
Subject: RFC: Increasing the default BCrypt cost
From: tim@bastelstu.be (=?UTF-8?Q?Tim_D=c3=bcsterhus?=)

Hi

in response to the recent "PASSWORD_DEFAULT value" thread [1], I've 
created an RFC to discuss an increase of the default BCrypt costs for 
`password_hash()` from the current value of 10.

https://wiki.php.net/rfc/bcrypt_cost_2023

This message is intended to officially open the discussion period for 
that RFC.

Best regards
Tim Düsterhus

[1] https://externals.io/message/120993