Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:124596
Date: Thu, 25 Jul 2024 18:26:51 -0400
To: Nick Lockheart <lists@ageofdream.com>
Cc: Internals <internals@lists.php.net>
Message-ID: <0A03EC18-A130-41A1-9064-AC88B161C94E@edison.tech>
In-Reply-To: <9041cba85d6439682bb44fcb29210c944dbe3911.camel@ageofdream.com>
References: <USzt7tZZlO1DmAbSTLhD-bqa23FqZn0zk2aah8Ndxgk9c7RY5PefQ8MjbYPUYAzr2_m4Cf-5AI4PuNBTS84rim_FNS6RaT-cWSv714HEvvU=@gpb.moe>
 <1a88918e-e808-d778-45e1-53797660e093@php.net>
 <CAPrKfG5Cw_nU7g7FR+t4C1-YZ8CDsDO_-sRs=yEsHO5kCTZL+A@mail.gmail.com>
 <c03eb187-bd21-4a4b-9faf-8d0243eaa994@varteg.nz>
 <aa6bc7aa-28d9-40ca-974f-65075adb6199@rwec.co.uk>
 <9041cba85d6439682bb44fcb29210c944dbe3911.camel@ageofdream.com>
Subject: Re: [PHP-DEV] [RFC] [VOTE] Deprecations for PHP 8.4
Precedence: bulk
MIME-Version: 1.0
Content-Type: multipart/alternative; boundary="66a2d12b_327b23c6_60ee"
From: mike@newclarity.net (Mike Schinkel)

--66a2d12b_327b23c6_60ee
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

     
 

 
 
 
 
 
 
 
 

 
 
>  
> On Jul 25, 2024 at 6:02 PM,  <Nick Lockheart (mailto:lists@ageofdream.com)>  wrote:
>    That's a good point. What if there were crypto functions that worked
>  
>  
>  like password_hash() in that they had one generic function name, but magically used the new/better "best practice" algorithms as time went by without the need to update any calling code? Maybe there should be three generic-named functions: fast_hash() // not secure, makes UIDs quickly secure_hash() // uses best practice one-way hash algo secure_crypt() // uses best practice reversible encryption. Then the developer signals their *intent* by choosing a function name, and the algorithm magically works underneath (perhaps with the option of an ini override to make those functions work in different environments). 
>
>  
 
 
 
 
 

 If those _were_ added, I would bikeshed their names to make sure their intent was 100% clear: 
>  
 
 
 

 
 
insecure_hash() // not secure, makes UIDs quickly
 
secure_oneway_hash() // uses best practice one-way hash algo
 
secure_reversible_hash() // uses best practice reversible encryption.
 

 
-Mike
 
 
     
--66a2d12b_327b23c6_60ee
Content-Type: text/html; charset="utf-8"
Content-Transfer-Encoding: quoted-printable
Content-Disposition: inline

<html><body><div id=3D=22edo-message=22><div></div><br></div><br><div id=3D=
=22edo-meta=22><div id=3D=22edo-signature=22 style=3D=22font-family: sans=
-serif, 'Helvetica Neue', Helvetica, Arial;=22></div></div><div id=3D=22e=
do-original=22><div><br><br><blockquote type=3D=22cite=22 style=3D=22marg=
in:1ex 0 0 0; height: min-content; border-left:1px =23ccc solid;padding-l=
eft:0.5ex;=22><div>On Jul 25, 2024 at 6:02 PM, &lt;<a href=3D=22mailto:li=
sts=40ageofdream.com=22>Nick Lockheart</a>&gt; wrote:<br><span style=3D=22=
-webkit-tap-highlight-color: transparent; text-align: inherit; background=
-color: inherit;=22>That's a good point. What if there were crypto functi=
ons that worked</span><br></div><div><pre class=3D=22edo-pre=22>like pass=
word=5Fhash() in that they had one generic function name, but
magically used the new/better =22best practice=22 algorithms as time went=

by without the need to update any calling code=3F

Maybe there should be three generic-named functions:

fast=5Fhash() // not secure, makes UIDs quickly
secure=5Fhash() // uses best practice one-way hash algo
secure=5Fcrypt() // uses best practice reversible encryption.

Then the developer signals their *intent* by choosing a function name,
and the algorithm magically works underneath (perhaps with the option
of an ini override to make those functions work in different
environments).</pre></div></blockquote><div id=3D=22edo-meta=22><div id=3D=
=22edo-signature=22 style=3D=22font-family: sans-serif, &quot;Helvetica N=
eue&quot;, Helvetica, Arial;=22></div></div><div id=3D=22edo-original=22>=
<br>If those =5Fwere=5F added, I would bikeshed their names to make sure =
their intent was 100% clear:<blockquote type=3D=22cite=22 style=3D=22marg=
in: 1ex 0px 0px; height: min-content; border-left-width: 1px; border-left=
-style: solid; border-left-color: rgb(204, 204, 204); padding-left: 0.5ex=
;=22></blockquote></div></div><div id=3D=22edo-original=22><br></div><div=
 id=3D=22edo-original=22><div id=3D=22edo-original=22>insecure=5Fhash() /=
/ not secure, makes UIDs quickly</div><div id=3D=22edo-original=22>secure=
=5Foneway=5Fhash() // uses best practice one-way hash algo</div><div id=3D=
=22edo-original=22>secure=5Freversible=5Fhash() // uses best practice rev=
ersible encryption.</div><div><br></div><div>-Mike</div></div></div></bod=
y></html>
--66a2d12b_327b23c6_60ee--