Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:61010
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.216.42 as permitted sender)
MIME-Version: 1.0
In-Reply-To: <CAL0xaBERa3tcz8+48KwLLdr=rYMUAG6Kumf=OhKCEa5wnwwCuQ@mail.gmail.com>
References: <CAAyV7nH6FCZUqrirJ0uOApuwR64Cky3cVnRfbrcjkZrpOKiN6w@mail.gmail.com>
	<CAJWj5+EA3vnNRMBxtVjcPhz1Ga5yqERkTnHoWsyx8Kxm05OEog@mail.gmail.com>
	<CAAyV7nETi6QxfAvPNFUzp02bX7Cm+ur5KnQH_CCahXH7qq7R_A@mail.gmail.com>
	<CAEZPtU7KGweFhOemFTc5O15DW4PK3qWErET+kx09Fa57JF2MhQ@mail.gmail.com>
	<op.wgj8g0h7idpuyk@damnation>
	<CAEZPtU4iPak5L3Ei=TKS9cnBY_vpEbRCbzSeqt8VUGye-m60Nw@mail.gmail.com>
	<CAAyV7nEq98jokXwu2eu4oiOpkEvQTEMaFb2fKk3DE=tiUi9-zQ@mail.gmail.com>
	<op.wgkaf1ocidpuyk@damnation>
	<CAEZPtU4bH9Mpj40OYP=k4oTQGhfdp3btf11GwvLUo59XS8O2uA@mail.gmail.com>
	<CAAyV7nFY_BbKQ5BPZ8Huzrc7114n5XeibTRpJ-MSJhW9apPscg@mail.gmail.com>
	<CAL0xaBEVkdCqy6sorYn7fpgx3sGs4NNmj+BGLUfjUeD+UVTqDA@mail.gmail.com>
	<CAAyV7nFrr4YSokgeJmCam0rqz_hJmXtzsN9L6eGcTYY80phU=A@mail.gmail.com>
	<CAL0xaBERa3tcz8+48KwLLdr=rYMUAG6Kumf=OhKCEa5wnwwCuQ@mail.gmail.com>
Date: Wed, 27 Jun 2012 21:52:49 -0400
Message-ID: <CAAyV7nGyL72S+0KnMPmPrAH0XU0gp79-4pvSY_+sDMa+U69W5A@mail.gmail.com>
To: Arvids Godjuks <arvids.godjuks@gmail.com>
Cc: internals@lists.php.net, Pierre Joye <pierre.php@gmail.com>, 
	Simon Schick <simonsimcity@gmail.com>, Gustavo Lopes <glopes@nebm.ist.utl.pt>
Content-Type: text/plain; charset=ISO-8859-1
Subject: Re: [PHP-DEV] [DRAFT RFC] Adding Simplified Password Hashing API
From: ircmaxell@gmail.com (Anthony Ferrara)

Arvids,

On Wed, Jun 27, 2012 at 12:32 PM, Arvids Godjuks
<arvids.godjuks@gmail.com> wrote:
> On that note I have only one request - please point me to the good article
> that describes how this thing works (I would prefer one that at least tries
> to explain in simple words) because at the moment i do not understand how
> salt stored in the hash itself makes hash more secure than an unsalted one.

Here are some articles that are worth while:

http://php.net/manual/en/function.crypt.php
http://www.devshed.com/c/a/PHP/Using-the-PHP-Crypt-Function/
http://stackoverflow.com/a/4808616/338665

If more explanation is needed, I can try to expand the RFC a bit more.
But give the new sections a read and let me know what you think.

Thanks,

Anthony