Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:60877
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.217.170 as permitted sender)
Content-Type: text/plain; charset=iso-8859-1
Mime-Version: 1.0 (Apple Message framework v1278)
In-Reply-To: <CAEZPtU6tXBgnTuGOfnjjFYyFJQ5iKpWX2Tq1U+wEaoyvBchW7A@mail.gmail.com>
Date: Mon, 18 Jun 2012 13:06:33 +0400
Content-Transfer-Encoding: quoted-printable
Message-ID: <3B162E01-67F6-4684-ACE7-40CAF73E9DC3@gmail.com>
References: <CAF+90c-6VWJ_kBW=Z8Br-NOxKyuTkwStRg-OMBa6844w3=CjDA@mail.gmail.com> <8714BC2A-45E2-4303-9769-8399AF316159@gmail.com> <CAEZPtU6tXBgnTuGOfnjjFYyFJQ5iKpWX2Tq1U+wEaoyvBchW7A@mail.gmail.com>
To: PHP internals <internals@lists.php.net>
Subject: Re: [PHP-DEV] Adding a simple API for secure password hashing?
From: indeyets@gmail.com (Alexey Zakhlestin)


On 18.06.2012, at 1:54, Pierre Joye wrote:

>> I guess SCrypt binding could be implemented.
>> http://www.tarsnap.com/scrypt.html
>=20
> Using yet another dependency for that? Not good.

That's easier and safer than implementing this on our own.

>=20
>> That's the best available option at the moment.
>> =
http://stackoverflow.com/questions/1226513/whats-the-advantage-of-scrypt-o=
ver-bcrypt
>=20
> This post says the exact opposite, just saying :)

The post says, that SCrypt is better, because it is way harder to solve.
Bcrypt requires a lot of CPU, but SCrypt requires a lot of CPU + a lot =
of RAM

>> It is BSD-licensed, so we can easily bundle it with PHP
>=20
> Maybe nice to have in pecl.'

Sure, that's an option, but pecl won't help php to have default =
"state-of-art" password hashing toolset ;)