Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:60880
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.216.52 as permitted sender)
MIME-Version: 1.0
In-Reply-To: <CAEZPtU7scvZegC8udp2eM65hYGHX4F-B_109GPMrXETOBjpRWg@mail.gmail.com>
References: <CAF+90c-6VWJ_kBW=Z8Br-NOxKyuTkwStRg-OMBa6844w3=CjDA@mail.gmail.com>
	<8714BC2A-45E2-4303-9769-8399AF316159@gmail.com>
	<CAEZPtU6tXBgnTuGOfnjjFYyFJQ5iKpWX2Tq1U+wEaoyvBchW7A@mail.gmail.com>
	<3B162E01-67F6-4684-ACE7-40CAF73E9DC3@gmail.com>
	<CAEZPtU7scvZegC8udp2eM65hYGHX4F-B_109GPMrXETOBjpRWg@mail.gmail.com>
Date: Mon, 18 Jun 2012 12:54:14 -0400
Message-ID: <CAAyV7nEfoBKeCJe8pXZQJWi+MD7JrrOTjSV8RJpvq=mGYL5iGg@mail.gmail.com>
To: Pierre Joye <pierre.php@gmail.com>
Cc: Alexey Zakhlestin <indeyets@gmail.com>, PHP internals <internals@lists.php.net>
Content-Type: text/plain; charset=ISO-8859-1
Subject: Re: [PHP-DEV] Adding a simple API for secure password hashing?
From: ircmaxell@gmail.com (Anthony Ferrara)

Pierre,

> There is sadly only state-of-art-right-now password hashing methods.
> We have to keep that in mind :)

That's why the crypt() return format was designed. All of the options
that are needed to validate the hash (algorithm, cost parameter, salt,
etc) are fit right into the outputted string.

I'd suggest that's what's done here. In fact, I'd make the functions
just a thin wrapper around crypt(). Basically, just where it sets sane
defaults that we can update every minor (or major) release (to
compensate for faster servers). It handles salt generation, error
checking, etc.

Here's what I have in mind in php: https://gist.github.com/2949382

Anthony