Newsgroups: php.internals Path: news.php.net Xref: news.php.net php.internals:60826 Return-Path: Mailing-List: contact internals-help@lists.php.net; run by ezmlm Delivered-To: mailing list internals@lists.php.net Received: (qmail 86239 invoked from network); 14 Jun 2012 13:36:01 -0000 Received: from unknown (HELO lists.php.net) (127.0.0.1) by localhost with SMTP; 14 Jun 2012 13:36:01 -0000 Authentication-Results: pb1.pair.com smtp.mail=ircmaxell@gmail.com; spf=pass; sender-id=pass Authentication-Results: pb1.pair.com header.from=ircmaxell@gmail.com; sender-id=pass Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.216.170 as permitted sender) X-PHP-List-Original-Sender: ircmaxell@gmail.com X-Host-Fingerprint: 209.85.216.170 mail-qc0-f170.google.com Received: from [209.85.216.170] ([209.85.216.170:51947] helo=mail-qc0-f170.google.com) by pb1.pair.com (ecelerity 2.1.1.9-wez r(12769M)) with ESMTP id 05/37-39100-0C8E9DF4 for ; Thu, 14 Jun 2012 09:36:01 -0400 Received: by qcmt36 with SMTP id t36so1098728qcm.29 for ; Thu, 14 Jun 2012 06:35:57 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc:content-type; bh=QBxhK0M6QkB9JgHl3AuMnI9WKe1M7UwcIEsC6X6itDA=; b=NzCgdykFCYBXObMonBibHu+XIBYMrFrL+miywxslC2selCnvLrfzRam4ZKY1X/wKWM a/+gCfNU3gb0PIep6gthj7WLfX3WfdgGKGSz0KaA3zXTZ1SbCcDgMhU2NSCFcwWzMuTn b1/WvJq3UUT9vz4IH7hP+mqto3pb5FmrEdpcY5Mi2RFaLxcvqpQfa0Mk8DX3WcVWx5j+ ZkIWEvGRuW6AV6TMVGRZPwrpWg23jQHp8RRPHgJ7t6ZNdBZkL8NOvsKlzj54b0IPxZ05 yQJZ5xiwcBUNbxfd5keXmcZLbPP+tAKyWwwcuqwWyxfBYWdk/D1dqsrzStrnsYBeFcRe fU8g== MIME-Version: 1.0 Received: by 10.229.69.31 with SMTP id x31mr884142qci.101.1339680957211; Thu, 14 Jun 2012 06:35:57 -0700 (PDT) Received: by 10.229.49.204 with HTTP; Thu, 14 Jun 2012 06:35:57 -0700 (PDT) In-Reply-To: References: Date: Thu, 14 Jun 2012 09:35:57 -0400 Message-ID: To: Peter Lind Cc: PHP internals Content-Type: text/plain; charset=ISO-8859-1 Subject: Re: [PHP-DEV] Adding a simple API for secure password hashing? From: ircmaxell@gmail.com (Anthony Ferrara) Peter, > Whether or not a CSPRNG is needed depends on what you're doing, your > needed level of security. Perhaps add a parameter to control this, so > it would be possible to make use of this function even if you need the > maximum level of security? If it's not available, the function should > fail in some suitable fashion. For password hashing, it won't ever be needed for the salt. The salt is not a secret in the context of cryptography. But, on that note, if we were adding a stronger PRNG generator, it would be good to expose it natively. And that native exposure would likely take a parameter for CS-safe PRNG... Just my $0.02... > *snip* > >> Or, we could implement a system like I did in >> https://github.com/ircmaxell/PHP-CryptLib/tree/master/lib/CryptLib/Random >> that follows RFC4086: http://tools.ietf.org/html/rfc4086#section-5.2 >> Where it mixes together several sources of weak and moderate strength >> PRNG... > > Will the entropy multiply by mixing sources? I.e. will the result be > "more random"? Won't it just be as random as the most random source? No, it will not multiply. It can in practice increase from the strongest source. But it will never be *weaker* than the strongest source. The reason for a mixing function like that, is that you're pulling entropy from multiple sources. So if a single source is compromised (say mt_rand is compromised with a known seed value), it doesn't reduce the overall strength of the generated value. If the strongest source is compromised, it will still be at least as strong as the next weakest source... Anthony > Other than that, the SPL version seems like a nice idea. > > Regards > Peter > > -- > > WWW: plphp.dk / plind.dk > LinkedIn: plind > BeWelcome/Couchsurfing: Fake51 > Twitter: kafe15 >