Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:53610
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: error (pb1.pair.com: domain schlueters.de from 217.114.211.66 cause and error)
To: David =?ISO-8859-1?Q?Z=FClke?= <david.zuelke@bitextender.com>
Cc: Stas Malyshev <smalyshev@sugarcrm.com>, Pierre Joye
 <pierre.php@gmail.com>,  Rasmus Lerdorf <rasmus@lerdorf.com>, PHP internals
 <internals@lists.php.net>
In-Reply-To: <7F006373-3753-48A6-BCB8-564B1020CB04@bitextender.com>
References: <4E06EF9A.4030603@lerdorf.com>	<4E07A696.2090602@sugarcrm.com>
	 <BANLkTi=TwEJ=+PAuX3wS68_CWtsBcriScg@mail.gmail.com>
	 <4E07C6D8.7040509@sugarcrm.com>
	 <7F006373-3753-48A6-BCB8-564B1020CB04@bitextender.com>
Content-Type: text/plain; charset="UTF-8"
Date: Tue, 28 Jun 2011 14:26:42 +0200
Message-ID: <1309264002.2331.15.camel@guybrush>
Mime-Version: 1.0
Content-Transfer-Encoding: 8bit
Subject: Re: [PHP-DEV] todo: crypt_blowfish issue
From: johannes@schlueters.de (Johannes =?ISO-8859-1?Q?Schl=FCter?=)

On Tue, 2011-06-28 at 12:19 +0200, David Zülke wrote:
> On 27.06.2011, at 01:55, Stas Malyshev wrote:
> 
> > However, it still has a chance somebody's data won't work after the
> update if he had 8-bit data hashed with old crypt(). He would need
> either to re-hash or to change prefix from $2a to $2x.
> 
> IMO that's a fair trade-off; people could even implement this in their
> app code by replacing "$2a" with "$2x" for a transitional period in
> the hash if the comparison fails (and then simply re-hash the password
> again with $2a so it's secure). I'm volunteering to write the
> necessary code sample for the upgrading notes :p

if people read it ... what might happen is that people test when
upgrading (yay!) all tests and all work and then 1% of the users or so
can't login anymore (with an european site for instance where 8bit
characters might happen ...)

johannes

> David
> 
>