Newsgroups: php.internals Path: news.php.net Xref: news.php.net php.internals:62961 Return-Path: Mailing-List: contact internals-help@lists.php.net; run by ezmlm Delivered-To: mailing list internals@lists.php.net Received: (qmail 35525 invoked from network); 12 Sep 2012 17:30:17 -0000 Received: from unknown (HELO lists.php.net) (127.0.0.1) by localhost with SMTP; 12 Sep 2012 17:30:17 -0000 Authentication-Results: pb1.pair.com header.from=adamjonr@gmail.com; sender-id=pass Authentication-Results: pb1.pair.com smtp.mail=adamjonr@gmail.com; spf=pass; sender-id=pass Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.214.170 as permitted sender) X-PHP-List-Original-Sender: adamjonr@gmail.com X-Host-Fingerprint: 209.85.214.170 mail-ob0-f170.google.com Received: from [209.85.214.170] ([209.85.214.170:38109] helo=mail-ob0-f170.google.com) by pb1.pair.com (ecelerity 2.1.1.9-wez r(12769M)) with ESMTP id F9/10-34511-9A6C0505 for ; Wed, 12 Sep 2012 13:30:17 -0400 Received: by obbwc18 with SMTP id wc18so3289556obb.29 for ; Wed, 12 Sep 2012 10:30:14 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :content-type; bh=rFkExiZl1zfgCLCQ2bi6m+vOoOqGxj9tGW1IcgJU5Gs=; b=ovZ6pkyccBcdOXFCRX2+XxVtbZH4oiMyo+z6l4feAbsDnu43IBziO6GD+WRMPi88nR aNNtTAfpXnZzwwgJFGfIhmMV1yrXLtTNHLeQXFo3usIL/9zKChbd5XvPUyM2ZikzFjNR PxlbfPQKou0tk1wVmDziMSILmfIK3jOJ/nTVH+gYfZII7CGsVSnmZ9E9q7+h7X/pjf2f xIQDk8FC4X4TdwUg2H93yjvID8c8qP5Cuso/Xu1sBpXuMpmB6QFbAeSLftFUgDrCsUAC OS5T5yhfWdOhR+Za1U26Mm31z5/sje6/NSNOCT8MQ5l8hMu8gHrBFDQoMEd9R1aIF1Wj Ow7A== MIME-Version: 1.0 Received: by 10.60.1.135 with SMTP id 7mr3227749oem.40.1347471014567; Wed, 12 Sep 2012 10:30:14 -0700 (PDT) Received: by 10.76.95.198 with HTTP; Wed, 12 Sep 2012 10:30:13 -0700 (PDT) In-Reply-To: References: Date: Wed, 12 Sep 2012 13:30:13 -0400 Message-ID: To: internals@lists.php.net Content-Type: text/plain; charset=ISO-8859-1 Subject: Re: [PHP-DEV] [VOTE] Add simplified password hashing API From: adamjonr@gmail.com (Adam Jon Richardson) On Wed, Sep 12, 2012 at 12:57 PM, Scott MacVicar wrote: > "There is no requirement for them to be cryptographically secure. " > What stops the salt from being cryptographically secure? I think it should be a goal or we should state what parts aren't cryptographically secure, is it the random data source? A salt (similar to a nonce), only needs to be unique within the system (see "Practical Cryptography" by Ferguson and Schneier) > "The salt parameter, if provided, will be used in place of an auto-generated salt." > This is setting someone up for failure by letting them put in something weak, you should be forced to get an auto-generated salt. If this is for unit testing then it should be explicitly stated. Again, the salt is only weak IFF it is not unique within that particular system (app, website, etc.) Making the easier option be the one that ensures the uniqueness seems reasonable here, as most developers will use the provided functionality, whilst maintaining the developers more comfortable with the security requirements involved with customization to do so with some modest extra work. Adam