Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:67464
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain adamharvey.name designates 209.85.223.178 as permitted sender)
MIME-Version: 1.0
Sender: adam@adamharvey.name
In-Reply-To: <CAF+90c-6yGbQwi0LfAAer5wqgN=7j1N+h6BYBDWNh0x8a8=v+A@mail.gmail.com>
References: <CAF+90c-6yGbQwi0LfAAer5wqgN=7j1N+h6BYBDWNh0x8a8=v+A@mail.gmail.com>
Date: Thu, 23 May 2013 13:39:34 -0700
Message-ID: <CADajX4CskTALYnO=x4LQS_oy7mAyNUKL3_Lg7_8LLKmyiZkEnw@mail.gmail.com>
To: Nikita Popov <nikita.ppv@gmail.com>
Cc: PHP internals <internals@lists.php.net>
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
Subject: Re: [PHP-DEV] Re: hash_pbkdf2 vs openssl_pbkdf2
From: aharvey@php.net (Adam Harvey)

On 23 May 2013 13:31, Nikita Popov <nikita.ppv@gmail.com> wrote:
> On Sat, May 18, 2013 at 11:48 AM, Nikita Popov <nikita.ppv@gmail.com> wro=
te:
>
>> Hi internals!
>>
>> I just noticed that we added the PBKDF2 algorithm two times in PHP 5.5.
>> Once in the hash extension, once in the OpenSSL extension.
>>
>> The hash_pbkdf2 function was added via this RFC:
>> https://wiki.php.net/rfc/hash_pbkdf2
>>
>> The openssl_pbkdf2 function probably was not noticed at that time becaus=
e
>> it was just commited, but not mentioned anywhere else (NEWS, UPGRADING,
>> etc). Only saw it in vrana's documentation updates just now. The relevan=
t
>> commit is here: https://github.com/php/php-src/commit/f4847ef
>>
>> It would be nice if we could have only one of those functions. I'm
>> currently tending towards the hash_ variant because of the commit messag=
e
>> of the openssl_ function:
>>
>> > No easy way to put these in the hash extension since we don't really
>> support optional
>> > parameters to certain algorithms. Implemented in openssl for now since
>> it has it already
>> > and is pretty stable.
>> >
>> > Only SHA1 is confirmed to work as an algorithm but openssl has a
>> parameter so it can be
>> > changed in the future.
>>
>> It seems that the author already would have preferred it in the hash
>> extension and that the openssl variant only works with sha1 (or was only
>> tested with it? not sure).
>>
>> Nikita
>>
>
> No more opinions? It would be nice to have this resolved before 5.5,
> otherwise there will be no way back.

I'm not really convinced this is a problem in practice =E2=80=94 hash_pbkdf=
2()
is likely to be the commonly used one because it doesn't have the
OpenSSL dependency, but it probably doesn't hurt to have the ability
to also call OpenSSL's independent implementation (say, if a bug is
found in one or the other).

Adam