Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:60919
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.216.51 as permitted sender)
MIME-Version: 1.0
In-Reply-To: <005701cd4ef5$606331c0$21299540$@com>
References: <CAAyV7nEw5uLC05dz+kqCrFtUJ9yOUeKvR6uZTGo8E6+TjYMoUA@mail.gmail.com>
	<005701cd4ef5$606331c0$21299540$@com>
Date: Thu, 21 Jun 2012 07:16:33 -0400
Message-ID: <CAAyV7nF2ifS7BZfzNsBQ=Q-OrTuD6VfUn8P2gvmL9s8evWoOfw@mail.gmail.com>
To: Jonathan Bond-Caron <jbondc@openmv.com>
Cc: internals@lists.php.net
Content-Type: text/plain; charset=ISO-8859-1
Subject: Re: [PHP-DEV] [RFC] Add hash_pbkdf2 function
From: ircmaxell@gmail.com (Anthony Ferrara)

Jonathan,

> I like this proposal, it could be useful to add a simpler api that has
> defaults matching the NIST recommendation:
> hash_password($password, $salt, $algo = 'sha1', $iterations = 1000);

Checkout the other thread about adding a simple password API.

As far as implementing that as well, I don't care for it. Basically,
the reason is that it limits the algorithms that can be called by
hash_password. Specifically scrypt would not be possible, because it
has more parameters than that.

> My point being that:
>
> $hash = hash_password('1234', 'my'. $password[1] .
> 'super-long-salt-secret');
>
> Gives good enough security 80% of use cases and is simpler then:
>
> $hash = hash_pbkdf2('sha1', '1234', 'my'. $password[1] .
> 'super-long-salt-secret', 1000);
>
> Developers will still use sha1 or md5 because they are so simple.

The goal of this API addition is not to simplify anything. It's to
provide a C implementation of the PBKDF2 algorithm. The other topic
about password hashing has the simplification goal.

Anthony