Newsgroups: php.internals Path: news.php.net Xref: news.php.net php.internals:54798 Return-Path: Mailing-List: contact internals-help@lists.php.net; run by ezmlm Delivered-To: mailing list internals@lists.php.net Received: (qmail 65267 invoked from network); 22 Aug 2011 13:52:51 -0000 Received: from unknown (HELO lists.php.net) (127.0.0.1) by localhost with SMTP; 22 Aug 2011 13:52:51 -0000 Authentication-Results: pb1.pair.com smtp.mail=solar@openwall.com; spf=pass; sender-id=pass Authentication-Results: pb1.pair.com header.from=solar@openwall.com; sender-id=pass Received-SPF: pass (pb1.pair.com: domain openwall.com designates 195.42.179.200 as permitted sender) X-PHP-List-Original-Sender: solar@openwall.com X-Host-Fingerprint: 195.42.179.200 mother.openwall.net Received: from [195.42.179.200] ([195.42.179.200:64330] helo=mother.openwall.net) by pb1.pair.com (ecelerity 2.1.1.9-wez r(12769M)) with ESMTP id 4A/32-49342-03F525E4 for ; Mon, 22 Aug 2011 09:52:51 -0400 Received: (qmail 7707 invoked from network); 22 Aug 2011 13:52:45 -0000 Received: from localhost (HELO pvt.openwall.com) (127.0.0.1) by localhost with SMTP; 22 Aug 2011 13:52:45 -0000 Received: by pvt.openwall.com (Postfix, from userid 503) id 35F3B2FDA0; Mon, 22 Aug 2011 17:52:10 +0400 (MSD) Date: Mon, 22 Aug 2011 17:52:10 +0400 To: Ferenc Kovacs Cc: Pierre Joye , PHP Internals List Message-ID: <20110822135210.GA14951@openwall.com> References: <20110719234406.GB28946@openwall.com> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.4.2.3i Subject: Re: [PHP-DEV] CRYPT_SHA256 fails tests in trunk From: solar@openwall.com (Solar Designer) On Mon, Aug 22, 2011 at 03:19:53PM +0200, Ferenc Kovacs wrote: > we expected this imo. > http://www.mail-archive.com/internals@lists.php.net/msg51683.html > http://www.mail-archive.com/internals@lists.php.net/msg51687.html Definitely. > On Mon, Aug 22, 2011 at 3:05 PM, Pierre Joye wrote: > > it seems that the changes break BC too, pls see > > https://bugs.php.net/bug.php?id=55477 We may recommend to Christian to change $2a$ in existing hashes to $2x$ if the goal is to preserve compatibility for all old passwords despite of the security risk associated with doing so. The change as implemented in PHP 5.3.7+ favors security and correctness over backwards compatibility, but it also lets users (admins of PHP app installs) use the new $2x$ prefix on existing hashes to preserve backwards compatibility for those and incur the associated security risk until all such passwords are changed (using $2a$ or $2y$ for newly changed passwords). No change to the PHP code is needed. BTW, this is not the right thread to discuss this on (the "bug" has nothing to do with CRYPT_SHA256). Alexander