Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:60962
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.216.182 as permitted sender)
MIME-Version: 1.0
In-Reply-To: <CAAyV7nGii+E6+ExnjkW-u3HWri=XO21mcwxji-2RPRvwHR_35Q@mail.gmail.com>
References: <CAF+90c-6VWJ_kBW=Z8Br-NOxKyuTkwStRg-OMBa6844w3=CjDA@mail.gmail.com>
	<8714BC2A-45E2-4303-9769-8399AF316159@gmail.com>
	<CAEZPtU6tXBgnTuGOfnjjFYyFJQ5iKpWX2Tq1U+wEaoyvBchW7A@mail.gmail.com>
	<3B162E01-67F6-4684-ACE7-40CAF73E9DC3@gmail.com>
	<CAEZPtU7scvZegC8udp2eM65hYGHX4F-B_109GPMrXETOBjpRWg@mail.gmail.com>
	<CAAyV7nEfoBKeCJe8pXZQJWi+MD7JrrOTjSV8RJpvq=mGYL5iGg@mail.gmail.com>
	<4FE0FC9C.5070900@gmail.com>
	<CAAyV7nGii+E6+ExnjkW-u3HWri=XO21mcwxji-2RPRvwHR_35Q@mail.gmail.com>
Date: Mon, 25 Jun 2012 11:43:13 -0400
Message-ID: <CAAyV7nFMphvtLjWvGZM1esLC2XyNwFFM1JWOBKYr4XqKOXa2WA@mail.gmail.com>
To: PHP internals <internals@lists.php.net>
Content-Type: text/plain; charset=ISO-8859-1
Subject: Re: [PHP-DEV] Adding a simple API for secure password hashing?
From: ircmaxell@gmail.com (Anthony Ferrara)

Hello again,

I have put together a quick proof-of-concept for the password API.

C:

https://github.com/ircmaxell/php-src/blob/hash_password/ext/standard/password.c

PHP (Implemented as a backwards-compatibility layer, so 5.3/5.4 users
can use the API earlier):

https://github.com/ircmaxell/password_compat/blob/master/lib/password.php

It needs some work before it's ready for an RFC, but it works as intended.

Right now, it defines 3 functions:

password_create($password, $algo = PASSWORD_DEFAULT, array $options = array())
password_verify($password, $hash)
password_make_salt($length, $raw_output = false)

Some of the things I want to change include the ability to set the
default bcrypt and sha* cost/round parameters via a php.ini setting
(right now, it's just a c constant). I also want to refactor it a bit
to clean it up. I also need to test it out fully... I also don't care
for the amount of PHP function calls it makes
(zend_call_method_with_n_params). But that may be ok, given the

What do you think so far?

Anthony

On Wed, Jun 20, 2012 at 6:05 AM, Anthony Ferrara <ircmaxell@gmail.com> wrote:
> Angel,
>
>> I don't think the code is the most appropiate one, but I suppose that's
>> not a final proposal.
>
> Correct, it was just to fill out the interface a bit so that people
> could play with it and see how the interface worked...
>
>> The interfaces look good to me.
>> I'd maybe set the default $algo to PASSWORD_DEFAULT_HASH or similar,
>> being a value bumped on each next revisions.
>
> Yeah, that's a good idea. Makes it easier to update without changing
> the interface.
>
>> I would consider preferable to have the $ ofpassword_register_algoprefix
>> implicit.
>
> That's fair.
>
> Thanks,
>
> Anthony