Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:60813
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain darkrainfall.org designates 209.85.161.170 as permitted sender)
MIME-Version: 1.0
In-Reply-To: <CAF+90c-6VWJ_kBW=Z8Br-NOxKyuTkwStRg-OMBa6844w3=CjDA@mail.gmail.com>
References: <CAF+90c-6VWJ_kBW=Z8Br-NOxKyuTkwStRg-OMBa6844w3=CjDA@mail.gmail.com>
Date: Wed, 13 Jun 2012 17:44:46 -0400
Message-ID: <CAMWw8k96wcWo3DEBZPX1LSLfqVYQOg9=PQhq0K9_WBGX5Lep6w@mail.gmail.com>
To: Nikita Popov <nikita.ppv@googlemail.com>
Cc: PHP internals <internals@lists.php.net>
Content-Type: text/plain; charset=UTF-8
Subject: Re: [PHP-DEV] Adding a simple API for secure password hashing?
From: gwynne@darkrainfall.org (Gwynne Raskind)

On Wed, Jun 13, 2012 at 5:31 PM, Nikita Popov <nikita.ppv@googlemail.com> wrote:
> Hi internals!
>
> Recent incidents have shown that even very large websites still don't
> get how to do password hashing properly. The sha1 hashes used by
> Linkedin et al can be easily cracked even by amateurs without special
> hardware.
>
> What could be the reason for this? Why don't people use bcrypt? It is
> being recommended already for *years*, but still most people don't
> seem to make use of it.
>
> I think the reason is that it is incredibly hard to use crypt()
> correctly, mainly for the following reasons:
>
> * For many people the syntax is hard to grasp. The hashing algorithm
> is specified as the salt parameter, which is somewhat non-obvious (at
> least for me).
> * The fact that you verify a password using $hash == crypt($password,
> $hash) is equally non-obvious.
> * Generating correct salts for bcrypt is quite complicated. It is
> encoded in some strange base64 format, thus requiring an additional
> function to create it. Additionally it isn't particularly easy to
> fetch the random bytes for the salt as you have to check several
> possibilities for a cross-platform solution (mcrypt initialization
> vector, openssl, /dev/*random, mt_rand etc).
>
> Correctly hashing a password with bcrypt thus requires about a hundred
> lines of code. So one either has to import a library (and strangely it
> seems that people don't like to do that!) or has to roll your own
> (usually implementing some part incorrectly...)
>
> Obviously it's somewhat tempting to use a one-liner sha1() hash
> instead of a hundred line bcrypt hash.
>
> So, wouldn't it be better if PHP provided an easy to use API for
> secure password hashes natively? So you just have to call a single
> function, which magically handles everything for you (like salt
> generation).
>
> A simple sample API could be two functions password_hash($password)
> and password_hash_verify($password, $hash). But it could just as well
> be a fancy, extensible OOP API.
>
> I think this would greatly improve the hashing situation for PHP.
>
> Thanks,
> Nikita

Strong +1 on this. I'd suggest writing an RFC.

-- Gwynne