Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:121032
Message-ID: <076e8c8a-9f17-0163-acad-87df7f4302a1@bastelstu.be>
Date: Sun, 10 Sep 2023 18:05:58 +0200
MIME-Version: 1.0
To: =?UTF-8?Q?Alexandru_P=c4=83tr=c4=83nescu?= <drealecs@gmail.com>
Cc: PHP internals <internals@lists.php.net>
References: <e6d0f349-436d-8545-4146-e1293c901d65@bastelstu.be>
 <CAAwdEzD=3cG17jCz8v4dT1qoCMOjxEgqh1UvSwk-MU2nVEMA2A@mail.gmail.com>
Content-Language: en-US
In-Reply-To: <CAAwdEzD=3cG17jCz8v4dT1qoCMOjxEgqh1UvSwk-MU2nVEMA2A@mail.gmail.com>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 8bit
Subject: Re: [PHP-DEV] RFC: Increasing the default BCrypt cost
From: tim@bastelstu.be (=?UTF-8?Q?Tim_D=c3=bcsterhus?=)

Hi

On 9/8/23 18:49, Alexandru Pătrănescu wrote:
>> in response to the recent "PASSWORD_DEFAULT value" thread [1], I've
>> created an RFC to discuss an increase of the default BCrypt costs for
>> `password_hash()` from the current value of 10.
>>
>> https://wiki.php.net/rfc/bcrypt_cost_2023
>>
>>
> 
> I think 12 looks reasonable.
> I've performed some tests myself on private hosted servers with
> newer hardware with good results for 12 around 0.1 seconds.

wow, that is a 33% reduction even compared to the Xeon E-2246G and thus 
hard to believe. What CPU is that?

> Can this be integrated into PHP 8.3, as it's not a new feature that can
> cause problems?

The release managers for PHP 8.3 would need to decide that. However I'd 
rather not include this in PHP 8.3 at this point.

> Pushing it to 8.4 will delay the real usage with 2-3 more years already.

IMO this is fine. Common frameworks can and do already use a different 
default. Symfony apparently is at 13 by default. Laravel uses 10, but 
I've already pinged someone on Mastodon to maybe have a look at the 
results of this RFC:

https://phpc.social/@timwolla/111025125667858110

The current default of 10 is not insecure and rolling this out a little 
more slowly will mean that more and more of the old and slow hardware 
will be retired and replaced by modern hardware, lessening the impact.

> I feel like the hardware performance improvements (specifically single
> thread performance) slightly increased in the past 3-4 years, and soon most
> of the hosting providers will be using it.
>

 From my experience as a developer of a software that is commonly run on 
shared hosting, web hosters *love* their ancient hardware, because it's 
fully depreciated from a taxation / accounting PoV and every extra day 
it is used is "free money". Customers commonly are not able to tell they 
are running with tens of other customers on this ancient hardware and 
thus won't complain ("loading times of 1 second are fine").

Best regards
Tim Düsterhus