Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:54820
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.213.42 as permitted sender)
MIME-Version: 1.0
In-Reply-To: <20110822153557.GA15691@openwall.com>
References: <20110719234406.GB28946@openwall.com>
	<CAEZPtU7Rjn5VQm6=Lm0HxNQCjfE6k0j+Lijx6TBcpuE9ZgfRCw@mail.gmail.com>
	<CAH-PCH74xN1HUjmKWWdsYe=8V=-wm0xCDgmT1K8oEX0y+Hiubw@mail.gmail.com>
	<20110822135210.GA14951@openwall.com>
	<CAEZPtU6nzV7s455sVyMK7gbsZJOZ0K8siK2tgKHtyzaCYALehw@mail.gmail.com>
	<20110822153557.GA15691@openwall.com>
Date: Tue, 23 Aug 2011 11:31:02 +0200
Message-ID: <CADNQb0XowY9=PwZ-4FFjKCop1S9u3gwGN_rg4dwpgiWowf-5cw@mail.gmail.com>
To: Solar Designer <solar@openwall.com>
Cc: Pierre Joye <pierre.php@gmail.com>, Ferenc Kovacs <tyra3l@gmail.com>, 
	PHP Internals List <internals@lists.php.net>
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
Subject: Re: [PHP-DEV] CRYPT_SHA256 fails tests in trunk
From: hannes.magnusson@gmail.com (Hannes Magnusson)

2011/8/22 Solar Designer <solar@openwall.com>:
> On Mon, Aug 22, 2011 at 04:01:46PM +0200, Pierre Joye wrote:
>> On Mon, Aug 22, 2011 at 3:52 PM, Solar Designer <solar@openwall.com> wro=
te:
>> >> On Mon, Aug 22, 2011 at 3:05 PM, Pierre Joye <pierre.php@gmail.com> w=
rote:
>> >> > it seems that the changes break BC too, pls see
>> >> > https://bugs.php.net/bug.php?id=3D55477
>> >
>> > We may recommend to Christian to change $2a$ in existing hashes to $2x=
$ if
>> > the goal is to preserve compatibility for all old passwords despite of
>> > the security risk associated with doing so. =C2=A0The change as implem=
ented
>> > in PHP 5.3.7+ favors security and correctness over backwards compatibi=
lity,
>> > but it also lets users (admins of PHP app installs) use the new $2x$
>> > prefix on existing hashes to preserve backwards compatibility for thos=
e
>> > and incur the associated security risk until all such passwords are
>> > changed (using $2a$ or $2y$ for newly changed passwords).
>> >
>> > No change to the PHP code is needed.
>>
>> Can you add this comment to the bug please? So every user reading it
>> will be informed. That's also something we have to document better.
>
> I just did - I added a more verbose comment, though. =C2=A0I think you ma=
y
> use this for documentation:

Added to http://php.net/security/crypt, and added a link from the
release announcement and changelog.
(should show up in an hour or two).

-Hannes