Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:54822
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 74.125.83.42 as permitted sender)
MIME-Version: 1.0
In-Reply-To: <20110823103056.GA19160@openwall.com>
References: <20110719234406.GB28946@openwall.com>
	<CAEZPtU7Rjn5VQm6=Lm0HxNQCjfE6k0j+Lijx6TBcpuE9ZgfRCw@mail.gmail.com>
	<CAH-PCH74xN1HUjmKWWdsYe=8V=-wm0xCDgmT1K8oEX0y+Hiubw@mail.gmail.com>
	<20110822135210.GA14951@openwall.com>
	<CAEZPtU6nzV7s455sVyMK7gbsZJOZ0K8siK2tgKHtyzaCYALehw@mail.gmail.com>
	<20110822153557.GA15691@openwall.com>
	<CADNQb0XowY9=PwZ-4FFjKCop1S9u3gwGN_rg4dwpgiWowf-5cw@mail.gmail.com>
	<20110823103056.GA19160@openwall.com>
Date: Tue, 23 Aug 2011 12:52:10 +0200
Message-ID: <CADNQb0VZNCjmkHJ9_nau71cAMgfehNd33_2NyGbYeANi74T5Rw@mail.gmail.com>
To: Solar Designer <solar@openwall.com>
Cc: Pierre Joye <pierre.php@gmail.com>, Ferenc Kovacs <tyra3l@gmail.com>, 
	PHP Internals List <internals@lists.php.net>
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
Subject: Re: [PHP-DEV] CRYPT_SHA256 fails tests in trunk
From: hannes.magnusson@gmail.com (Hannes Magnusson)

On Tue, Aug 23, 2011 at 12:30, Solar Designer <solar@openwall.com> wrote:
> On Tue, Aug 23, 2011 at 11:31:02AM +0200, Hannes Magnusson wrote:
>> Added to http://php.net/security/crypt, and added a link from the
>> release announcement and changelog.
>> (should show up in an hour or two).
>
> Thanks. =C2=A0I suggest the following three changes:
>
> 1. Change the title from "crypt() security fix details" to
> CRYPT_BLOWFISH security fix details" to avoid confusion with the
> CRYPT_MD5 problem inadvertently introduced in 5.3.7.

done


> 2. Remove this paragraph:
>
> BTW, PHP 5.3.7+ has been updated to crypt_blowfish 1.2, not the
> intermediate 1.1 release referenced in the previous comment. The
> differences between 1.1 and 1.2 include introduction of the
> countermeasure for $2a$ mentioned above and the $2y$ prefix.
>
> which made sense in the bug comments (after a preceding comment), but is
> unneeded here.

done



>
> 3. Maybe the URL should be .../crypt_blowfish rather than .../crypt,
> since there will definitely be more fixes/changes to PHP's crypt(), some
> of which might need their own release notes. =C2=A0It might be too late t=
o
> make this change, though.

done.
Added a fallback from /security/crypt to /security/crypt_blowfish for
the time being.

-Hannes