Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:121005
Message-ID: <cc9d622b-40d7-298f-3a81-cb4bcbc0d128@bastelstu.be>
Date: Thu, 7 Sep 2023 19:31:03 +0200
MIME-Version: 1.0
Content-Language: en-US
To: Vinicius Dias <carlosv775@gmail.com>,
 Hans Henrik Bergan <divinity76@gmail.com>
Cc: PHP internals <internals@lists.php.net>
References: <CAEwRQKZK6zGh4UYPc60QZATjfiy32Jq-7TCuucN723JtrwpTHg@mail.gmail.com>
 <86811a7b-e5c7-0d00-7726-6502e8c34479@bastelstu.be>
 <CAJmy8YECZJN6K0t-rfw1EjMiRvRNEvWkhC7Af92rjsey2xPr2g@mail.gmail.com>
 <CAEwRQKb0Vuj46sdTLKq7d5_gvDokzHVeDTh1hPMaojPe5pkapg@mail.gmail.com>
In-Reply-To: <CAEwRQKb0Vuj46sdTLKq7d5_gvDokzHVeDTh1hPMaojPe5pkapg@mail.gmail.com>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 8bit
Subject: Re: [PHP-DEV] PASSWORD_DEFAULT value
From: tim@bastelstu.be (=?UTF-8?Q?Tim_D=c3=bcsterhus?=)

Hi

On 9/6/23 21:33, Vinicius Dias wrote:
> This is very interesting. It's the first time I see recommendations
> pro Bcrypt and against Argon2. Even Owasp recommends Argon2 over
> Bcrypt [1].
> 
> I am not a cryptography expert so I believe that if there is a
> discussion of which one is better PHP shouldn't change things for now,
> so that totally answers the question of why the default is still
> bcrypt.
> 

There is some opportunity for change or improvement. As a result of this 
thread I've created an "Increasing the default BCrypt cost" RFC. I'd be 
happy to see you within that RFC's discussion thread [1].

Best regards
Tim Düsterhus

[1] https://news-web.php.net/php.internals/121004