Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:61891
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.216.170 as permitted sender)
MIME-Version: 1.0
In-Reply-To: <005101cd6f18$9da38510$d8ea8f30$@com>
References: <CAAyV7nFRT24rksh6iDWxstfQwJ4+KdEC7Zs6EC8wBtJ8Zorf7w@mail.gmail.com>
	<4FFF1831.8070902@sugarcrm.com>
	<CAAyV7nHi0k6S-zbi5=xCE8EmXpaEds9RoZTB8RPOeO8K_ZLY=w@mail.gmail.com>
	<005101cd6f18$9da38510$d8ea8f30$@com>
Date: Tue, 31 Jul 2012 09:25:19 -0400
Message-ID: <CAAyV7nGOiVD0=z+6nJKAhr6qu96GuU4+nBTTQiizcP9DxNRUUg@mail.gmail.com>
To: Jonathan Bond-Caron <jbondc@openmv.com>
Cc: internals@lists.php.net
Content-Type: multipart/alternative; boundary=00248c768f92152f9404c6201c6c
Subject: Re: [PHP-DEV] [PROPOSED] password_hash RFC - Implementing simplified
 password hashing functions
From: ircmaxell@gmail.com (Anthony Ferrara)

--00248c768f92152f9404c6201c6c
Content-Type: text/plain; charset=ISO-8859-1

Jonathan,

On Tue, Jul 31, 2012 at 8:32 AM, Jonathan Bond-Caron <jbondc@openmv.com>wrote:

> On Thu Jul 12 02:34 PM, Anthony Ferrara wrote:
> >
> > > https://wiki.php.net/rfc/password_hash
>
>
> -- password_hash()
>
> password_hash_rfc(string $password, int $algo, array $options = array())
>
> My personal opinion is the api should be:
>
> password_hash(string $password, string $secret = '', array $options =
> array());
>
> where $options['method'] = PASSWORD_METHOD_BCRYPT;
>
> Some people mentioned that the method/algorithm in should be the api? What
> was the problem if crypt() stores the actual method/algorithm in the hash?
>
> Using this api, we let crypt() should a random salt value and we pick our
> secret.
>
> Say you have:
> define('MY_HASHING_SECRET', 'hhtrg54~%$%4....long');
> $password = '1234';
>
> password_hash_rfc($password . MY_HASHING_SECRET, PASSWORD_METHOD_BCRYPT);
> password_hash($password, MY_HASHING_SECRET);
>
> Note here that in both cases we let crypt() generate a random salt that is
> different for every password and store in the password.
>
> But our 'secret' that is appended to every password is not stored in a
> database for example, it's in some ways similar to a private key.
>

Please see this section of the RFC:
https://wiki.php.net/rfc/password_hash#the_api_does_not_support_pepper


> -- password_make_salt()
>
> I would remove the need for this function.
>
> I think it's important the api emphasizes the importance of keeping a
> 'secret' + has the added value that every password hash is different with a
> crypt() salt.
>
> Thoughts?
>
>
>

--00248c768f92152f9404c6201c6c--