Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:124600
Feedback-ID: id5114917:Fastmail
Date: Fri, 26 Jul 2024 07:44:17 +0100
To: internals@lists.php.net
Subject: Re: [PHP-DEV] [RFC] [VOTE] Deprecations for PHP 8.4
User-Agent: K-9 Mail for Android
In-Reply-To: <e5379886fefbd0485e7b3ef488e8bf790b2c575e.camel@ageofdream.com>
References: <USzt7tZZlO1DmAbSTLhD-bqa23FqZn0zk2aah8Ndxgk9c7RY5PefQ8MjbYPUYAzr2_m4Cf-5AI4PuNBTS84rim_FNS6RaT-cWSv714HEvvU=@gpb.moe> <1a88918e-e808-d778-45e1-53797660e093@php.net> <CAPrKfG5Cw_nU7g7FR+t4C1-YZ8CDsDO_-sRs=yEsHO5kCTZL+A@mail.gmail.com> <c03eb187-bd21-4a4b-9faf-8d0243eaa994@varteg.nz> <aa6bc7aa-28d9-40ca-974f-65075adb6199@rwec.co.uk> <9041cba85d6439682bb44fcb29210c944dbe3911.camel@ageofdream.com> <66A2D544.5060801@adviesenzo.nl> <e5379886fefbd0485e7b3ef488e8bf790b2c575e.camel@ageofdream.com>
Message-ID: <B4AAB40D-61C3-4710-A917-1F444200DC12@rwec.co.uk>
Precedence: bulk
MIME-Version: 1.0
Content-Type: text/plain;
 charset=utf-8
Content-Transfer-Encoding: quoted-printable
From: imsop.php@rwec.co.uk ("Rowan Tommins [IMSoP]")



On 25 July 2024 23:54:53 BST, Nick Lockheart <lists@ageofdream=2Ecom> wrot=
e:
>Doesn't password_hash() handle this automatically? The result of the
>password_hash() function includes the hash and the algorithm used to
>hash it=2E That way password_verify() magically works with the string
>that came from password_hash()=2E

For password hashing, you are always retrieving the hash for a specific us=
er, and then making a yes/no decision about it=2E Indeed, it's an explicit =
aim that an attacker can't take a password and quickly scan a captured data=
base for matching hashes=2E

For other uses of hashes, though, the opposite is true: you want to search=
 for matching hashes=2E For instance, when you store a file in git, it calc=
ulates the SHA1 hash of its content to use as a lookup key=2E If that key a=
lready exists in the local database, it assumes the content is the same=2E

That also demonstrates another difference: hashes are often shared between=
 applications, where they need to be using an agreed algorithm=2E If a pack=
age manager requires SHA1 hashes of each file, you can't just substitute SH=
A256 hashes without some other agreed changes=2E

Tempting though a "secure_hash" function is, I don't think it's practical =
for a lot of the places hashing is used=2E

Regards,
Rowan Tommins
[IMSoP]