Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:68400
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.128.178 as permitted sender)
MIME-Version: 1.0
In-Reply-To: <CAGa2bXZPwU=MNS3gvcsQK6uEfdTsbk8K9OMX7Y4ZUOUFCJy8HA@mail.gmail.com>
References: <CAGa2bXZPwU=MNS3gvcsQK6uEfdTsbk8K9OMX7Y4ZUOUFCJy8HA@mail.gmail.com>
Date: Wed, 7 Aug 2013 09:50:11 -0400
Message-ID: <CAAyV7nEHVwTBTctKDfRV-8GFwdRqAkNivWabGKc1fqnVUJT5mQ@mail.gmail.com>
To: Yasuo Ohgaki <yohgaki@ohgaki.net>
Cc: "internals@lists.php.net" <internals@lists.php.net>
Content-Type: multipart/alternative; boundary=089e016357c403b76804e35bd229
Subject: Re: [PHP-DEV] crypt() should raise error without 2nd parameter
From: ircmaxell@gmail.com (Anthony Ferrara)

--089e016357c403b76804e35bd229
Content-Type: text/plain; charset=ISO-8859-1

Yasuo,

Hi all,
>
> A user requested that crypt() should raise error without 2nd(slat)
> parameter.
>
> https://bugs.php.net/bug.php?id=55036
>
> crypt() without salt generates extremely weak password hash. In addition to
> this,
> PHP 5.5 has password_hash()
>
> This change should be applied from 5.5, IMHO.
>
> Any comments?
>
> --
> Yasuo Ohgaki
> yohgaki@ohgaki.net
>

Well, first off, a BC break like this should never go into a current
release. So I'd support for master / NEXT only anyway.

I did some digging, and it appears that the python module also does similar
behavior (allowing a null salt). But their behavior is to generate a strong
salt for the strongest algorithm available. So their behavior is actually
useful.

The other implementations that I've looked at would all error or simply
ignore the fact that the salt was empty (as a valid DES salt).

So, keeping with standard practices, I think we should E_DEPRECATE the
usage with only 1 parameter (no salt), and then in NEXT.NEXT change the
zend_parse_parameters definition to require 2 parameters...

My $0.02...

--089e016357c403b76804e35bd229--