Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:121047
Message-ID: <7da23206-9cd9-947d-fa19-645ae21923cb@bastelstu.be>
Date: Tue, 12 Sep 2023 18:01:27 +0200
MIME-Version: 1.0
To: Hans Henrik Bergan <divinity76@gmail.com>
Cc: PHP internals <internals@lists.php.net>
References: <e6d0f349-436d-8545-4146-e1293c901d65@bastelstu.be>
 <CAAwdEzD=3cG17jCz8v4dT1qoCMOjxEgqh1UvSwk-MU2nVEMA2A@mail.gmail.com>
 <076e8c8a-9f17-0163-acad-87df7f4302a1@bastelstu.be>
 <CAJmy8YGW6PTuVvUijHQ4jBHnd-jtHMg8EtuuASR=VP5gmQjo1g@mail.gmail.com>
Content-Language: en-US
In-Reply-To: <CAJmy8YGW6PTuVvUijHQ4jBHnd-jtHMg8EtuuASR=VP5gmQjo1g@mail.gmail.com>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 8bit
Subject: Re: [PHP-DEV] RFC: Increasing the default BCrypt cost
From: tim@bastelstu.be (=?UTF-8?Q?Tim_D=c3=bcsterhus?=)

Hi

On 9/12/23 17:56, Hans Henrik Bergan wrote:
>> web hosters *love* their ancient hardware
> 
> No kidding. dreamhost.com host over 1.5 million websites, presumably most
> are on their "Shared Unlimited" package, which runs on
> AMD Opteron 4122, a high-end server CPU from 2010.
> Some benchmarks there:

It appears your benchmarks are broken, because you're also measuring the 
startup cost of PHP itself. You should see an approximate doubling in 
time taken for each increase of the cost, but you have 122ms for 9 and 
166ms for 10.

A simple microtime(true) benchmark loop as used with my test script 
should be fine for ballpark estimates, as password_hash() is pretty 
heavy, dwarfing the measurement overhead.

Best regards
Tim Düsterhus