Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:121125
MIME-Version: 1.0
References: <a9b0d24f-fe59-75af-4b1e-dcd8067482b0@bastelstu.be>
In-Reply-To: <a9b0d24f-fe59-75af-4b1e-dcd8067482b0@bastelstu.be>
Date: Fri, 22 Sep 2023 09:04:29 +0200
Message-ID: <CAOWwgp=cJWtF8GS6h9Aq42bwJXTwbkG1L1LpcS7HLqK0hrj5rQ@mail.gmail.com>
To: =?UTF-8?Q?Tim_D=C3=BCsterhus?= <tim@bastelstu.be>
Cc: PHP internals <internals@lists.php.net>
Content-Type: multipart/alternative; boundary="000000000000f94d8c0605ed381a"
Subject: Re: [PHP-DEV] [VOTE] Increasing the default BCrypt cost
From: nicolas.grekas+php@gmail.com (Nicolas Grekas)

--000000000000f94d8c0605ed381a
Content-Type: text/plain; charset="UTF-8"

I just opened the vote for the "Increasing the default BCrypt cost" RFC.
> The RFC contains a two votes, one primary vote that requires a 2/3
> majority to pass and a secondary vote deciding on the new costs with a
> simple majority. Voting runs 2 weeks until 2023-10-05 17:45 UTC.
>
> Please find the following resources for your references:
>
> RFC Text: https://wiki.php.net/rfc/bcrypt_cost_2023
> Discussion Thread: https://externals.io/message/121004
> Feedback by a Hashcat team member on Fediverse:
> https://phpc.social/@tychotithonus@infosec.exchange/111025157601179075
>


Hi Tim,

For the record, I voted for 11 because I think it's nicer to end users (I
guess many don't know they could have a potential DoS vector via password
submissions), and also because it's going to be easy to raise again in
8.5/9.0.

I was wondering if you considered also raising the Argon2 default cost? Has
this been discussed?

Thanks for the RFC

Nicolas

--000000000000f94d8c0605ed381a--