Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:124441
Precedence: bulk
MIME-Version: 1.0
References: <bw20I5b7ly3lSbI-2Bv3kfrfTVJbDo5RhwBiQa1PEwuLjprDJWptPajLiaialj1RLVKu7z1j0MofJUhhRVtzT_5i2E11oKeQx_VMUxnKhUE=@gpb.moe>
 <6683CDE4.7050607@adviesenzo.nl> <Skh-IB3l7OxslclNZdB5ZE3G5PaIvpoz3iojK10noNbXkj1odNNvzI5w7X1aSj7IKZ951646yQ8IrUW_wNaQuv94NB0jo3IXlFImcpu_hxc=@gpb.moe>
 <668B5728.40300@adviesenzo.nl> <3XlxyoEWXN5MLqWhlh4uQMXGc2DRs7OH72f_InABxrhsBVTZIPOrfO3qEKqG94844M2r3FUS_zGMa60dENgvLP6TC8zOWZASkN6w6ZxsaxM=@gpb.moe>
 <af9e728a-5961-4f90-85f9-f03b397fe837@app.fastmail.com> <7322787a-2c35-4926-baae-84cf46a6acea@bastelstu.be>
In-Reply-To: <7322787a-2c35-4926-baae-84cf46a6acea@bastelstu.be>
Date: Mon, 15 Jul 2024 17:36:09 -0500
Message-ID: <CAB_ngDhMduGcw4UF5EDgvfd_vAV6_--AAEEQMwiATrztt1ggHw@mail.gmail.com>
Subject: Re: [PHP-DEV] [RFC] Deprecations for PHP 8.4
Cc: internals@lists.php.net
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
From: brandonja991@gmail.com (Brandon Jackson)

On Mon, Jul 15, 2024 at 4:31=E2=80=AFPM Tim D=C3=BCsterhus <tim@bastelstu.b=
e> wrote:
>
> Yes it does. SHA-256 is safer than MD5. And on modern CPUs with sha_ni
> extensions, it's also faster. The following is on a Intel i7-1365U:
>
> > $ openssl speed md5 sha1 sha256 sha512
> > *snip*
> > version: 3.0.10
> > built on: Wed Feb 21 10:45:39 2024 UTC
> > options: bn(64,64)
> > compiler: *snip*
> > CPUINFO: OPENSSL_ia32cap=3D0x7ffaf3ffffebffff:0x98c027bc239c27eb
> > The 'numbers' are in 1000s of bytes per second processed.
> > type             16 bytes     64 bytes    256 bytes   1024 bytes   8192=
 bytes  16384 bytes
> > md5             114683.10k   286174.51k   550288.90k   715171.50k   783=
611.22k   788556.46k
> > sha1            138578.57k   440607.38k  1082163.29k  1674088.45k  2017=
296.38k  2047377.41k
> > sha256          150670.11k   460483.71k  1054829.57k  1553830.57k  1807=
897.94k  1823981.57k
> > sha512           41246.76k   181566.07k   341457.66k   645468.50k   781=
042.81k   804296.02k
> Tim D=C3=BCsterhus

Oh, that's interesting information. Blindly assuming that md5 was
faster than sha256, I did occasionally use md5 for non security
sensitive things like creating hashes used as cache keys or something
similar.

Consider something like:

$cache_key =3D md5(json_encode([
  'query' =3D> "SELECT * FROM books WHERE author =3D ? LIMIT $offset,$limit=
",
  'params' =3D> $params,
  'db' =3D> 'kids_books',
]));

I think that would resolve my last possible reason for continuing to use md=
5.