Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:53612
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.160.170 as permitted sender)
MIME-Version: 1.0
In-Reply-To: <53677D08-D961-490B-B0FF-865F4915B6AB@bitextender.com>
References: <4E06EF9A.4030603@lerdorf.com>
	<4E07A696.2090602@sugarcrm.com>
	<BANLkTi=TwEJ=+PAuX3wS68_CWtsBcriScg@mail.gmail.com>
	<4E07C6D8.7040509@sugarcrm.com>
	<7F006373-3753-48A6-BCB8-564B1020CB04@bitextender.com>
	<1309264002.2331.15.camel@guybrush>
	<53677D08-D961-490B-B0FF-865F4915B6AB@bitextender.com>
Date: Tue, 28 Jun 2011 14:40:22 +0200
Message-ID: <BANLkTineN2QJFKBVHdADu0THP0rpU7SrJQ@mail.gmail.com>
To: =?UTF-8?B?RGF2aWQgWsO8bGtl?= <david.zuelke@bitextender.com>
Cc: =?UTF-8?Q?Johannes_Schl=C3=BCter?= <johannes@schlueters.de>, 
	Stas Malyshev <smalyshev@sugarcrm.com>, Pierre Joye <pierre.php@gmail.com>, 
	Rasmus Lerdorf <rasmus@lerdorf.com>, PHP internals <internals@lists.php.net>
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
Subject: Re: [PHP-DEV] todo: crypt_blowfish issue
From: tyra3l@gmail.com (Ferenc Kovacs)

2011/6/28 David Z=C3=BClke <david.zuelke@bitextender.com>:
> On 28.06.2011, at 14:26, Johannes Schl=C3=BCter wrote:
>
>> On Tue, 2011-06-28 at 12:19 +0200, David Z=C3=BClke wrote:
>>
>>> On 27.06.2011, at 01:55, Stas Malyshev wrote:
>>>
>>>> However, it still has a chance somebody's data won't work after the
>>>> update if he had 8-bit data hashed with old crypt(). He would need
>>>> either to re-hash or to change prefix from $2a to $2x.
>>>
>>> IMO that's a fair trade-off; people could even implement this in their
>>> app code by replacing "$2a" with "$2x" for a transitional period in
>>> the hash if the comparison fails (and then simply re-hash the password
>>> again with $2a so it's secure). I'm volunteering to write the
>>> necessary code sample for the upgrading notes :p
>>
>> if people read it ... what might happen is that people test when
>> upgrading (yay!) all tests and all work and then 1% of the users or so
>> can't login anymore (with an european site for instance where 8bit
>> characters might happen ...)
>
> That might happen, but it isn't a critical issue I think since the change=
 does not produce unconsumable hashes or silently corrupt data in some othe=
r way. I think you're also overestimating the amount of people using bcrypt=
 for password storage; most people unfortunately still use SHA1s (with or w=
ithout a salt).
>
> As Stas said though, whatever the upstream implementation uses as a solut=
ion should be mirrored by PHP. The alternative would be to introduce a new =
hash algorithm code that only works in newer versions of PHP, which hurts p=
ortability (which is the major selling point of crypt()). Simply "breaking"=
 old hashes (there's not gonna be many of them out there) with the ability =
to easily and transparently fix it without user interaction in userland cod=
e seems like a much better idea to me.
>
> David
>
>
>

it would be good if we could communicate this change more than
mentioning in the changelog.

Tyrael