Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:60860
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.161.170 as permitted sender)
MIME-Version: 1.0
In-Reply-To: <CAAyV7nEKuta7rFx2ZAQQyD6JMA6z2G3UGF-ETmPbcs73vy74GQ@mail.gmail.com>
References: <CAF+90c-6VWJ_kBW=Z8Br-NOxKyuTkwStRg-OMBa6844w3=CjDA@mail.gmail.com>
	<CAKOpQSzHLWhQxe9D2hjAo+O4AevoAEL4vFAhkoyxiZS8fvc3GA@mail.gmail.com>
	<CAAUB37CP1pCKCAvvQ56EkeT_0VdjpXwd_=FnQct+9XZTou0_GA@mail.gmail.com>
	<CAAyV7nEKuta7rFx2ZAQQyD6JMA6z2G3UGF-ETmPbcs73vy74GQ@mail.gmail.com>
Date: Sat, 16 Jun 2012 15:39:35 +0200
Message-ID: <CAEZPtU7pH1mW-_sF1pPw=-8zYG-cFEd8XQk7N4KnWFNuKF3jAQ@mail.gmail.com>
To: Anthony Ferrara <ircmaxell@gmail.com>, Solar Designer <solar@openwall.com>
Cc: Herman Radtke <hermanradtke@gmail.com>, Nikita Popov <nikita.ppv@googlemail.com>, 
	PHP internals <internals@lists.php.net>
Content-Type: text/plain; charset=ISO-8859-1
Subject: Re: [PHP-DEV] Adding a simple API for secure password hashing?
From: pierre.php@gmail.com (Pierre Joye)

hi Anthony,

Adding Alex to the loop as his insight will be unvaluable in this thread.

On Sat, Jun 16, 2012 at 2:41 PM, Anthony Ferrara <ircmaxell@gmail.com> wrote:

>> This userland library already solves all the issues you outlined with
>> bcrypt: http://www.openwall.com/phpass/
>
> That library is not without its issues. For example, if you ask for a
> portable hash, it gives you a custom algorithm instead of bcrypt.
> That's because the library is php4 compatible. So for modern versions
> of PHP (5.3+), it produces an unnecessarily weak hash.

Because it was exciting before.

However the point here is not the implementation but the APIs.

To be honest I am not a big fan of providing such an API in the core
as no matter the default implementation, it will become obsolete soon
or later. And changing the default brings its lot of issues and BC
problems.

That being said, it seems that we may not have the choice anyway so
having a well designed and implemented API for password (and related
or similar areas) generations may be a good thing.


Cheers,
-- 
Pierre

@pierrejoye | http://blog.thepimp.net | http://www.libgd.org