Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:75116
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.216.53 as permitted sender)
MIME-Version: 1.0
In-Reply-To: <20140627050910.GA27102@openwall.com>
References: <20140627050910.GA27102@openwall.com>
Date: Fri, 27 Jun 2014 17:02:17 +0200
Message-ID: <CAH-PCH6fcrP3_axO0BFZ3-C+06wOVPumd7=cZcigD3s1hgHC3g@mail.gmail.com>
To: Solar Designer <solar@openwall.com>
Cc: PHP internals <internals@lists.php.net>, Sherif Ramadan <googleguy@php.net>
Content-Type: multipart/alternative; boundary=047d7bdc8ac467c5df04fcd29894
Subject: Re: [PHP-DEV] PHP 5.4+ UPGRADING wrongly lists $2z$
From: tyra3l@gmail.com (Ferenc Kovacs)

--047d7bdc8ac467c5df04fcd29894
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

On Fri, Jun 27, 2014 at 7:09 AM, Solar Designer <solar@openwall.com> wrote:

> Hi,
>
> I just noticed that when we patched the crypt_blowfish signedness bug in
> 2011, a commit to the UPGRADING file for PHP 5.4+ wrongly listed $2z$ as
> a supported prefix.  It is not supported.
>
> This:
>
> - Fixed crypt_blowfish handling of 8-bit characters. crypt() in Blowfish
> mode
>   now supports hashes marked $2a$, $2x$, $2y$ and $2z$.
>
> should be corrected to:
>
> - Fixed crypt_blowfish handling of 8-bit characters. crypt() in Blowfish
> mode
>   now supports hashes marked $2a$, $2x$, and $2y$.
>

fixed, thanks for spotting.


>
> While at it, can someone please correct the recently added warning at
> http://www.php.net/manual/en/function.crypt.php which now reads:
>
> "Using the CRYPT_BLOWFISH algorithm, will result in the str parameter
> being truncated to a maximum length of 72 characters. This is only a
> concern if are using the same salt to hash strings with this algorithm
> that are over 72 bytes in length, as this will result in those hashes
> being identical."
>
> to be just:
>
> "Using the CRYPT_BLOWFISH algorithm will result in the str parameter
> being truncated to a maximum length of 72 characters."
>
> The statement starting "This is only ..." is wrong.
>
>
Removed the misleading explanation for
http://www.php.net/manual/en/function.crypt.php and
http://www.php.net/manual/en/function.password-hash.php for now, Sherif:
feel free to put it back if you think you can come up with something which
is both easy to understand but also precise.

--=20
Ferenc Kov=C3=A1cs
@Tyr43l - http://tyrael.hu

--047d7bdc8ac467c5df04fcd29894--