Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:60878
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.213.170 as permitted sender)
MIME-Version: 1.0
In-Reply-To: <3B162E01-67F6-4684-ACE7-40CAF73E9DC3@gmail.com>
References: <CAF+90c-6VWJ_kBW=Z8Br-NOxKyuTkwStRg-OMBa6844w3=CjDA@mail.gmail.com>
	<8714BC2A-45E2-4303-9769-8399AF316159@gmail.com>
	<CAEZPtU6tXBgnTuGOfnjjFYyFJQ5iKpWX2Tq1U+wEaoyvBchW7A@mail.gmail.com>
	<3B162E01-67F6-4684-ACE7-40CAF73E9DC3@gmail.com>
Date: Mon, 18 Jun 2012 17:42:26 +0200
Message-ID: <CAEZPtU7scvZegC8udp2eM65hYGHX4F-B_109GPMrXETOBjpRWg@mail.gmail.com>
To: Alexey Zakhlestin <indeyets@gmail.com>
Cc: PHP internals <internals@lists.php.net>
Content-Type: text/plain; charset=ISO-8859-1
Subject: Re: [PHP-DEV] Adding a simple API for secure password hashing?
From: pierre.php@gmail.com (Pierre Joye)

hi,

On Mon, Jun 18, 2012 at 11:06 AM, Alexey Zakhlestin <indeyets@gmail.com> wrote:

> The post says, that SCrypt is better, because it is way harder to solve.
> Bcrypt requires a lot of CPU, but SCrypt requires a lot of CPU + a lot of RAM

Ah right, I read it the other way 'round...

>>> It is BSD-licensed, so we can easily bundle it with PHP
>>
>> Maybe nice to have in pecl.'
>
> Sure, that's an option, but pecl won't help php to have default "state-of-art" password hashing toolset ;)

There is sadly only state-of-art-right-now password hashing methods.
We have to keep that in mind :)

Cheers,
-- 
Pierre

@pierrejoye | http://blog.thepimp.net | http://www.libgd.org