Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:124598
Message-ID: <e5379886fefbd0485e7b3ef488e8bf790b2c575e.camel@ageofdream.com>
Subject: Re: [PHP-DEV] [RFC] [VOTE] Deprecations for PHP 8.4
To: internals@lists.php.net
Date: Thu, 25 Jul 2024 18:54:53 -0400
In-Reply-To: <66A2D544.5060801@adviesenzo.nl>
References: 
	<USzt7tZZlO1DmAbSTLhD-bqa23FqZn0zk2aah8Ndxgk9c7RY5PefQ8MjbYPUYAzr2_m4Cf-5AI4PuNBTS84rim_FNS6RaT-cWSv714HEvvU=@gpb.moe>
	 <1a88918e-e808-d778-45e1-53797660e093@php.net>
	 <CAPrKfG5Cw_nU7g7FR+t4C1-YZ8CDsDO_-sRs=yEsHO5kCTZL+A@mail.gmail.com>
	 <c03eb187-bd21-4a4b-9faf-8d0243eaa994@varteg.nz>
	 <aa6bc7aa-28d9-40ca-974f-65075adb6199@rwec.co.uk>
	 <9041cba85d6439682bb44fcb29210c944dbe3911.camel@ageofdream.com>
	 <66A2D544.5060801@adviesenzo.nl>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
User-Agent: Evolution 3.46.4-2 
Precedence: bulk
MIME-Version: 1.0
From: lists@ageofdream.com (Nick Lockheart)

On Fri, 2024-07-26 at 00:44 +0200, Juliette Reinders Folmer wrote:
> On 26-7-2024 0:00, Nick Lockheart wrote:
> =C2=A0
> >=20
> > That's a good point. What if there were crypto functions that
> > worked
> > like password_hash() in that they had one generic function name,
> > but
> > magically used the new/better "best practice" algorithms as time
> > went
> > by without the need to update any calling code?
> >=20
> > Maybe there should be three generic-named functions:
> >=20
> > fast_hash() // not secure, makes UIDs quickly
> > secure_hash() // uses best practice one-way hash algo
> > secure_crypt() // uses best practice reversible encryption.
> =C2=A0
> =C2=A0While I like the idea, this sounds like a huge nightmare in the
> waiting when data is stored somewhere and later compared.
> =C2=A0
> =C2=A0Example:
> =C2=A0* Let's say these functions get introduced in PHP 8.5.
> =C2=A0* `secure_hash()` is used in an application running on PHP 8.5 to
> secure some data before storing it in a database. This data is used
> in comparisons - stored vs user provided.
> =C2=A0* Now in PHP 9.1, the hash algorithm is changed.
> =C2=A0* The production environment gets updated to PHP 9.1 and suddenly
> the application breaks as the data verification will no longer work
> as the new algo is used on the user provided data, but the database
> stored version of the same data was created with the old algo....
> =C2=A0

Doesn't password_hash() handle this automatically? The result of the
password_hash() function includes the hash and the algorithm used to
hash it. That way password_verify() magically works with the string
that came from password_hash().