Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:121018
MIME-Version: 1.0
References: <e6d0f349-436d-8545-4146-e1293c901d65@bastelstu.be>
In-Reply-To: <e6d0f349-436d-8545-4146-e1293c901d65@bastelstu.be>
Date: Fri, 8 Sep 2023 19:49:58 +0300
Message-ID: <CAAwdEzD=3cG17jCz8v4dT1qoCMOjxEgqh1UvSwk-MU2nVEMA2A@mail.gmail.com>
To: =?UTF-8?Q?Tim_D=C3=BCsterhus?= <tim@bastelstu.be>
Cc: PHP internals <internals@lists.php.net>
Content-Type: multipart/alternative; boundary="0000000000005459970604dbc54d"
Subject: Re: [PHP-DEV] RFC: Increasing the default BCrypt cost
From: drealecs@gmail.com (=?UTF-8?Q?Alexandru_P=C4=83tr=C4=83nescu?=)

--0000000000005459970604dbc54d
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

On Thu, Sep 7, 2023 at 8:26=E2=80=AFPM Tim D=C3=BCsterhus <tim@bastelstu.be=
> wrote:

> Hi
>
> in response to the recent "PASSWORD_DEFAULT value" thread [1], I've
> created an RFC to discuss an increase of the default BCrypt costs for
> `password_hash()` from the current value of 10.
>
> https://wiki.php.net/rfc/bcrypt_cost_2023
>
>

I think 12 looks reasonable.
I've performed some tests myself on private hosted servers with
newer hardware with good results for 12 around 0.1 seconds.

Can this be integrated into PHP 8.3, as it's not a new feature that can
cause problems?
Pushing it to 8.4 will delay the real usage with 2-3 more years already.

I feel like the hardware performance improvements (specifically single
thread performance) slightly increased in the past 3-4 years, and soon most
of the hosting providers will be using it.

Thank you for looking into this. Having good security configuration by
default is important.

Regards,
Alex

--0000000000005459970604dbc54d--